Which statement best describes security plan?

A. bypassing management approval B. sharing passwords publicly C. documenting controls, responsibilities, and protection requirements D. removing all documentation