Answer:
The statement is: False.
Explanation:
Companies use security policies to minimize the impact of threats. They provide a wide range of ideas on what the security goals of the organization are but how to apply them relies on managers. Managers are responsible to find out what the resources of the firm are so those policies can be implemented.