All of the following are true of IT policy frameworks, except: A. an IT policy framework includes policies, standards, baselines, procedures, guidelines, and a taxonomy. B. the framework must define the business as usual (BAU) activities and accountabilities needed to ensure information security policies are maintained. C. an IT policy framework should be fully accessible by executives and managers, with relevant highlights shared with general employees. D. you can measure success by how well the framework helps reduce risk to the organization.