Option 1: Correct: Security policies and procedures should be regularly reviewed and updated to ensure they align with changing threats and technologies. This helps to maintain the effectiveness of the policies and processes.
Option 2: Incorrect: Security policies and procedures should be accessible to relevant employees and stakeholders, not restricted only to the IT department. It is important for everyone to understand and adhere to the policies and procedures.
Option 3: Incorrect: Security policies and procedures should be regularly updated as needed, not documented once and never changed. The changing threat landscape and evolving technologies necessitate the periodic review and update of security policies and procedures.
Option 4: Incorrect: Security policies and procedures should be communicated and shared with employees to ensure everyone understands and follows them. Keeping them confidential and not sharing them would hinder their effectiveness.