A company creates policies but has no process for examining risk or monitoring whether requirements are followed. Which assessment is best supported by the course material?

### Why this is right Creating policies is one step in the program, but the course also calls for a risk analysis process, controls, and monitoring and response. The company has therefore addressed only part of the proposed sequence. ### The concept A compliance program needs more than written rules. Risk analysis helps determine which risks and requirements need attention. Controls are selected to mitigate or transfer relevant risk, while policies communicate expectations. Monitoring checks whether those expectations and controls are being followed, and response addresses issues that are found. Leaving out risk analysis and monitoring makes it harder to know whether the policies address important risks or work in practice. ### The other options - **A. The company has completed the compliance program because policies alone are sufficient.**: policies are only one listed step, not the whole program. - **C. The company should replace all policies with optional guidelines.**: the material calls for creating policies; it does not recommend replacing them with optional guidance. - **D. The company has proved that its controls prevent cyberattacks.**: having policies does not prove that controls work or guarantee that attacks will be prevented. ### Remember A policy states expectations, but risk analysis, controls, monitoring, and response make the program operational.