Which three statements accurately describe a security policy?

It creates a basis for legal action if necessary

It defines a process for managing security violations.

It defines acceptable and unacceptable use of network resources.