What is the legal precedence for federal information security policy?

• A. Constitution
• B. Public Law
• C. Executive Orders/Presidential Directives
• D. Industry Standards

Answer: (C)

Executive Orders and Presidential Directives set the government-wide policy for information security and bind federal agencies to follow those requirements. They translate the President’s authority into concrete obligations, assigning responsibilities and establishing the baseline security posture that agencies must implement, often through regulations and agency programs. The Constitution provides the broad legal framework, but it does not specify day-to-day security requirements. Public Law (statutes) gives the statutory mandates (like funding and formal duties), yet the direct policy direction comes from those presidential directives and orders. Industry standards, while influential, are not legally binding on federal agencies unless adopted by directive or statute. So the binding policy framework for federal information security is established by Executive Orders/Presidential Directives.