Which element is contained in the Information Security Program Plan?

• A. Defines roles, responsibilities, management commitment, and coordination
• B. Establishes the annual training budget for staff
• C. Specifies physical security measures for data centers
• D. Defines the company's encryption key rotation schedule

Answer: (A)

The Information Security Program Plan is about governance and oversight of the security effort. It defines who is responsible for information security activities, what their roles and responsibilities are, and how leadership commits to and coordinates the security program across the organization. This framing ensures accountability and alignment across teams, which is exactly what the plan is meant to establish. Details like budgets, specific physical security controls, or exact key rotation schedules belong in separate documents or policies (for example, budgeting documents, physical security policies, and cryptography/key management procedures), not in the program plan.