What is the primary purpose of a security policy?

• A. To increase employee productivity
• B. To establish rules and procedures to protect an organization's physical and informational assets
• C. To allow unrestricted access to data
• D. To limit employee rights within the organization

Answer: (B)

The primary purpose of a security policy is to establish rules and procedures that protect an organization’s physical and informational assets. This framework provides guidelines for how data and resources should be managed, accessed, and secured. A security policy aims to mitigate risks by setting clear expectations for behavior and actions relating to security, thereby ensuring that both employees and the organization as a whole can operate safely and effectively.

By having defined protocols, organizations can ensure that sensitive information is handled properly, access to resources is controlled, and any potential threats are managed proactively. This not only helps in safeguarding against data breaches or physical theft but also aligns with legal and regulatory requirements concerning data protection and privacy.

In contrast, options that suggest increasing productivity or allowing unrestricted access to data do not align with the fundamental goal of a security policy, which is to ensure security and protection. Similarly, while limiting employee rights might be a consideration in some contexts, it diverges from the core focus of protecting organizational assets.