The answer is false. The answer must be an information security blueprint. This is the basis for the design, selection, and implementation of all security program elements. The blueprint specifies tasks and the order in which they are to be accomplished, just like an architect’s blueprint serves as the design template for a construction of a building.