How is the purpose of information security policy best described?

An information security policy documents the analysis of risks and the search for countermeasures.

An information security policy provides direction and support to the management regarding information security.

An information security policy makes the security plan concrete by providing it with the necessary details.

An information security policy provides insight into threats and the possible consequences.