Which option is a correct example of applying security policy?

A. a high-level management statement for information security B. disabling audit logs C. removing all documentation D. ignoring risks and controls