The Security Policy interface can appear when the server is configured to use security questions and verified access IP addresses.
When this policy is enabled, cPanel can challenge a login from an unverified IP address with configured security questions. Successfully answering the questions can add that address to the verified list.
This feature is server-policy dependent. If the interface is not visible, do not assume the account is missing a required configuration; the server may simply use different authentication controls such as 2FA.