A mayor’s office wants distinct written policies for information security, business continuity, disaster recovery, incident response, secure development, and change control. Why separate them?
Select an answer to reveal the explanation.
Short Explanation
Different municipal risks need different rulebooks—IR playbooks are not the same as SDLC security or change-control gates. Separating information security, BCP, DR, IR, SDLC, and change-management policies keeps owners and duties clear. One vague mega-memo usually means nobody knows which section applies.
Full Explanation
Distinct written policies exist because different operational risk domains carry different objectives, stakeholders, and obligations. Information security policy governs confidentiality, integrity, and availability controls across systems. Business continuity and disaster recovery policies address sustained operations and restoration after disruption. Incident response policy defines declaration, roles, and handling of security events. Secure development policy covers how applications are built and maintained securely. Change control policy governs how modifications to production systems are requested, approved, and implemented. Separating them clarifies ownership, review cycles, and compliance mapping for a mayor’s office rather than burying incompatible requirements in one vague memo.
A single unlabeled memo for all risk domains obscures accountability and makes audits harder. Claiming only disaster recovery needs documentation ignores IR, change, security, and development obligations that local government still carries. Leaving change management undocumented to “stay agile” invites unmanaged production risk and contradicts governance practice. Exam tip: when stems list multiple policy types, the rationale is different domains and obligations—not consolidation into one informal note. Operationally, maintain a policy inventory with owners for each type, align review schedules to risk (and after major incidents), and ensure staff know which policy applies when handling citizen data, outages, code releases, or emergency firewall changes.