Which component should not be included in a security policy?

You are the network engineer at Your company. Which component should not be included in a
security policy?

A.
Identification and authentication policy

B.
Incident handling procedure

C.
Security best practice

D.
Statement of authority and scope