Which of the following should be included in an organization's IS security policy? 
A、A list of key IT resources to be secured 
B、The basis for access authorization 
C、Identity of sensitive security features 
D、Relevant software security features