Information Security policies should be __________________?

Information Security policies should be __________________? (Choose all that apply)

A.
Written down

B.
Clearly Communicated to all system users

C.
Audited and revised periodically

D.
None of the choices listed are correct