What type of document defines the strategy, approach, and expectations within an organization?

Comprehensive and Detailed Explanation (250–350 words)

===========

In the EC-Council CCISO framework, a policy is the highest-level governance document and is used to define the organization’s security strategy, management intent, direction, and expectations.

CCISO documentation clearly distinguishes between governance document types. Policies establish what must be done and why, while procedures define how tasks are performed, standards define specific mandatory requirements, and guidelines provide recommended best practices.

Policies are approved by executive leadership and serve as the foundation for all subordinate security documentation. The CCISO program emphasizes that effective CISOs ensure policies align with business objectives, regulatory requirements, and risk tolerance.

Therefore, Option D: Policy is correct.