Which statement best describes security policy?

A. sharing passwords publicly B. a high-level management statement for information security C. choosing office wall colors D. bypassing management approval