Aprocedureprovides step-by-step instructions on how to complete a specific security task, ensuring consistency and accuracy. Unlike policies, which define high-level security expectations,procedures are detailed and operational. For example, apassword reset procedurewould outline the exact steps IT support must follow when assisting users.
Policy: Defines security objectives and rules (e.g., "All passwords must be complex").
Standard: Specifies required technologies or configurations.
Guideline: Provides recommendations but is not mandatory.
Procedure: Gives exact instructions to perform tasks.
Reference:CompTIA Security+ SY0-701 Official Study Guide, Security Program Management and Oversight domain.

Business email compromise (BEC) is a type of targeted phishing attack where an attacker gains access to a legitimate business email account (or convincingly impersonates one) to manipulate financial transactions, such as redirecting payments to a fraudulent bank account. The scenario described matches this pattern.
Reference:
CompTIA Security+ SY0-701 Official Study Guide, Domain 2.2: "Business email compromise involves manipulating legitimate business communications to divert funds or sensitive information." Exam Objectives 2.2: "Given a scenario, analyze potential indicators associated with application attacks."

Code signing uses digital signatures to verify software authenticity and integrity, ensuring the code has not been tampered with since it was signed by the developer. It helps detect if malware was introduced after delivery.
Static code analysis (B) inspects code for vulnerabilities during development but does not verify delivered binaries. Input validation (C) protects applications at runtime. Secure storage (A) protects stored data, unrelated to software delivery.
Code signing is an essential security control in Software Development Life Cycle and Supply Chain Security
#6:Chapter 7 CompTIA Security+ Study Guide#.