Information Security: Principles and Practices 2nd Edition by Jim Breithaupt, Mark S. Merkow

Exercise 5

Which of the following would be the first step in establishing an information security programme?

A. adoption of a corporate information security policy statement

B. development and implementation of an information security standards manual

C. development of a security awareness-training program for employees

D. purchase of security access control software

Step 1 of 2

First step of information security programme

To develop an information security program, the goal of the program policy must be defined first, so that necessary procedures can be defined.

Thus, the correct option is A.