Which layer is described as 'The rules, policies, and management controls that govern the actions of users'?

• A. 8 - User
• B. 3 - Network
• C. 7 - Application
• D. 9 - Policies

Answer: (D)

Governance and policy controls shape how people are allowed to act in a system. The description points to the layer that sets the rules, permissions, and enforcement mechanisms guiding user behavior—what users can do, under what circumstances, and how violations are detected and handled. This includes security policies, acceptable use policies, access control policies, and incident response procedures. These governance elements translate risk decisions into concrete controls implemented across people, processes, and technology.

The other layers focus on different aspects: a user layer centers on the people and their roles; a network layer handles connectivity and data flow; an application layer covers software functionality. So the rules and management controls that govern user actions fit the policies layer.