Which of the following is typically NOT included within the scape of an organization's network access policy?

A network access policy defines the rules and requirements for connecting to and using an organization's network resources. It focuses on logical access controls. This includes user authentication methods, rules for remote connections (e.g., VPN), and acceptable use guidelines. Procedures for data backup and recovery, while a critical IT security function, are typically detailed in a separate Business Continuity and Disaster Recovery (BCDR) policy. The BCDR policy addresses data resilience and service restoration, which is distinct from the scope of controlling active access to the network.

(Based on inferred standard options)

A. Rules for remote access connections: This is a core component of a network access policy, defining how users connect securely from outside the corporate network.

B. User authentication methods: This is fundamental to network access, specifying requirements like passwords, MFA, and biometrics to verify user identity.

D. Acceptable use guidelines: This section outlines what users are permitted and prohibited from doing while connected to the network, forming a key part of the policy.

1. Shared Assessments. (2023). Standardized Information Gathering (SIG) Questionnaire. Domain: Access Control. The SIG questionnaire includes specific questions on policies governing remote access, authentication, and authorization, distinguishing them from BCDR controls found in the "Business Resilience" domain.

2. Tipton, H. F., & Krause, M. (Eds.). (2007). Information Security Management Handbook, Sixth Edition. CRC Press. Chapter 10, "Access Control," details the components of access control policies, focusing on identification, authentication, authorization, and accountability, separate from disaster recovery planning.