Some Organizations Have Information Protection Policies That Place the Burden

Some organizations have information protection policies that place the burden of information protection on managers in individual organizational units. An information protection policy may include:

A) Statements that define information as an asset that must be protected to different degrees based on its sensitivity, criticality, and value, regardless of the media on which it is stored, the manual or automated systems that process it, or the methods by which it is distributed
B) Statements outlining the responsibilities of information owners, custodians and users
C) Definitions of the previously audited data and its classifications
D) Both A & B