Security frameworks establish behavior expectations and define policy. policies cannot address every scenario employees will face, but strong training on the core principles that create those policies will equip employees to do their jobs successfully. true or false?

True

Explanation:

Policies should ideally be based on principles, while at the same time addressing as many specific situations as possible.

A security policy cannot refer to every possible event that might affect the security inside a company, a city, or even a country, but it should lay out the conceptual basis from which enforcers can reach conclusion in case the have to face an unspecified situation.