Which activity is NOT part of the security policy lifecycle?

Which activity is NOT part of the security policy lifecycle?

• A. Create policies
• B. Publish policies
• C. Develop incident response plans
• D. Retire policies

Answer: (C)

The activity being tested is the distinction between governance documents and operational procedures. The security policy lifecycle centers on creating policies, publishing them so stakeholders can access and follow them, and retiring policies that are outdated or no longer applicable. These steps ensure governance remains current and enforceable. Developing incident response plans, while essential to an organization’s security program, belongs to incident management or operations rather than the policy lifecycle. It’s about outlining how to detect, respond to, and recover from security incidents, often guided by existing policies but not itself a policy artifact. The incident response plan is an operational plan, not a policy document being created, published, or retired.

The activity being tested is the distinction between governance documents and operational procedures. The security policy lifecycle centers on creating policies, publishing them so stakeholders can access and follow them, and retiring policies that are outdated or no longer applicable. These steps ensure governance remains current and enforceable.

Developing incident response plans, while essential to an organization’s security program, belongs to incident management or operations rather than the policy lifecycle. It’s about outlining how to detect, respond to, and recover from security incidents, often guided by existing policies but not itself a policy artifact. The incident response plan is an operational plan, not a policy document being created, published, or retired.