What statement$($s$)$ is$/$are true regarding information security policies?

Question $7$ options:

quality information security program begins and ends with policy

the least expensive means of control and often the most difficult to implement

should never conflict with law

must be able to stand up in court if challenged

properly supported and administered

All the above