Security policy is primarily the responsibility of$1.$ data users$\mathrm{.}2.$ data custodians$\mathrm{.}3)$data owners$\mathrm{.}4)$ information technology.