What is the primary purpose of a security policy in an organization?

• A. To outline general employee responsibilities
• B. To define the rules and procedures for maintaining security
• C. To manage device inventories within the network
• D. To evaluate vendor compliance

Answer: (B)

The primary purpose of a security policy in an organization is to define the rules and procedures for maintaining security. This includes outlining how security measures should be implemented, who is responsible for different security tasks, and how to respond to various security incidents. A well-structured security policy provides a clear framework that guides employees in understanding their roles in protecting sensitive information and resources, ensuring compliance with legal and regulatory standards, and establishing accountability.

While other options like outlining employee responsibilities and managing device inventories are important aspects of security management, they are components of the broader security policy rather than its primary focus. The evaluation of vendor compliance is also crucial but falls under the implementation and enforcement of the security policy rather than defining its core objectives. Therefore, option B is accurately identified as the fundamental aim of a security policy within an organization.