Which of the following is NOT true for a good security policy?

A security policy will take the form of a document or a collection of documents, depending on the situation or usage. It can become a point of reference in case a violation occurs that results in dismissal or other penalty.

Which of the following is NOT true for a good security policy?
A . It must be enforceable with security tools where appropriate and with sanctions where actual prevention is not technically feasible
B . It must be approved by court of law after verifications of the stated terms and facts
C . It must be implemented through system administration procedures, publishing of acceptable use guide lines or other appropriate methods
D . It must clearly define the areas of responsibilities of the users, administrators and management

Answer: B