When creating a company's security policy, it is not necessary that the scope align with the company's annual information security budget. True False