An organization is developing a security program that conveys the responsibilities associated with the general operation of systems and software within the organization. Which of the following documents would most likely communicate these expectations?

An acceptable use policy (AUP) defines the proper way users can utilize an organization's IT assets, including systems and software. It clearly outlines user responsibilities and expected behavior, making it the most suitable document for communicating these operational expectations. A business continuity plan focuses on maintaining critical functions during disruptions, not daily operational responsibilities. A change management procedure details the process for implementing changes to IT systems, not general usage guidelines. A software development life cycle (SDLC) policy outlines the stages and security considerations for developing new software, not user responsibilities for existing systems.