An information security policy must be:
A. Distributed and communicated
B. Enforceable and Regularly updated
C. Written in simple language
D. All the above