(What type of policy provides instructions on what actions should be taken by the organization?

A prescriptive policy tells people and the organization what they must do—it prescribes required actions or behaviors. This is distinct from a proscriptive policy, which focuses on what is prohibited (“must not do”). In governance and compliance programs, prescriptive policies are used to establish mandatory practices such as access approvals, incident reporting steps, required reviews, data handling requirements, or minimum security configurations. They support consistent execution, accountability, and auditability by making expectations explicit and measurable. A procedural policy can include step-by-step processes, but “procedures” are typically subordinate artifacts that operationalize policy; the question is asking the policy type that provides instructions on actions to be taken, which aligns most directly with the prescriptive/proscriptive distinction. Ethical conduct policies set behavioral expectations and principles, but they are not the general classification for “instructions on what actions should be taken.” Therefore, option A is the best fit: it reflects the standard GRC taxonomy where prescriptive = required actions.