An executive asks why the organization needs security policy instead of only technical standards. Which response is best?

1. Policy prevents all unauthorized behavior automatically
2. Policy replaces technical validation
3. Policy is relevant only after a breach
4. Policy communicates management direction and accountability