Choice "D" is correct. Corporate culture is generally not a document but instead defines the mutually understood manner in which a company does business. While corporate culture is compatible with security policy, it is not a supporting "document."
Choices "c", "a", and "b" are incorrect. Security policy supporting documents might include regulations, company or industry adopted standards, and company procedures.
