The correct answer is D because the primary purpose of an acceptable use policy is to define and document expectations for how users may use organizational information systems, networks, devices, applications, internet access, email, data, and other resources. It communicates permitted and prohibited activities, user responsibilities, monitoring expectations, privacy limitations, disciplinary consequences, and requirements for protecting information assets. Aligning business units to the information security policy is a broader governance objective, not the specific objective of an acceptable use policy. Employee acknowledgement is useful evidence that users have received or accepted the policy, but acknowledgement is not the primary purpose. Managing third-party access is usually addressed through access management, vendor agreements, and third-party risk controls. In CISM governance, policies define expected behavior and provide a foundation for accountability. The acceptable use policy specifically sets expectations for appropriate use of organizational resources. Therefore, documenting expectations for resource use is the most important objective.
Reference: CISM Information Security Governance; acceptable use policy, user responsibilities, policy communication, and accountability.