An acceptable use policy $($AUP$)$ for different types of users is a training guide and direction document for other controls. What else is true about an AUP?

It is not the only security control for the User Domain, but it is an important one.

It is not the only security control for the User Domain and must be used in conjunction with the Business Domain.

It is the only security control for the User Domain.

It is not the only security control for the User Domain, and it is a trivial one.