to avoid confusion, an organization should have a written security policy for a minimum number of security components. group of answer choices true false