Which of the following best describes an issue-specific policy?

A. Used to create a management-sponsored computer security program
B. Focuses on policy issues that management has decided for a specific system
C. Establishes the overall approach to computer security
D. Addresses specific issues of concerns to the organization

Answer: D
Explanation: Issue-specific policies address specific issues of concern to the organization, such as regulatory issues like HIPAA, SOX, PCI, and others.