Which of the following best describes the scope of a physical security policy?

• A. A formal document outlining rules for access control, incident reporting, visitor handling, and safety.
• B. A casual memo about security awareness.
• C. A budget plan for security equipment.
• D. A set of legal regulations with no procedures.

Answer: (C)

The scope of a physical security policy is the formal set of rules and procedures that govern how security is managed across the organization. It defines what must be done, by whom, and under what circumstances, covering actions like access control, incident reporting, visitor handling, and safety practices. This formal document provides enforceable guidance that applies organization-wide, ensuring consistent protective measures.

A casual memo about security awareness lacks the required authority and detail; it doesn’t establish the mandatory rules or procedures needed for ongoing protection. A budget plan for security equipment focuses on costs and procurement rather than defining the rules and methods for guarding people and assets. A set of legal regulations with no procedures describes compliance requirements but not an internal policy that dictates how day-to-day security operations should be carried out.