Which of the following is NOT true?

An organization's security policies establish how the organization achieves the regulatory requirements while meeting business goals.

A regulatory agency may be granted the authority under the law to establish regulations.

An organization's security policies are interpretations of legal requirements that lead to compliance.

Regulatory requirements establish what an organization has to do to meet business goals.