Lesson 14 - Group 1: Policies, Standards, Guidelines, and Procedures

Policy

A governance document that establishes organizational rules, expectations, decision-making frameworks, and required behaviors.

What are the primary purposes of organizational policies?

To establish governance, support compliance, align the organization around common goals, prevent misconduct, and reduce inefficiencies.

What common policies are listed in Lesson 14?

Acceptable use, information security, business continuity and COOP, disaster recovery, incident response, SDLC, and change-management policies.

AUP

Acceptable Use Policy.

Guideline

A flexible recommendation that steers actions within a job role or department.

How does a guideline differ from a policy?

A guideline allows greater implementation flexibility, while a policy establishes organizational rules and expectations.

Procedure

Step-by-step instructions or checklists that ensure a task is completed in a compliant and repeatable way.

What procedure examples are listed?

Onboarding and offboarding, background checks, provisioning, desktop deployment, patching, go-live actions, after-hours support, and ticket management.

Playbook

A collection of critical actions, generally associated with Security Operations.

Standard

A document that defines best practices and specific implementation details associated with policies or regulations.

Why can a standard change more frequently than a policy?

Standards contain specific technical details that may require regular updates while the higher-level policy remains unchanged.

What industry standards are listed in Lesson 14?

ISO 27000 series, NIST 800 series Special Publications, PCI DSS, and FIPS.

Policy versus standard versus procedure

A policy states organizational requirements, a standard provides specific required details, and a procedure explains the steps used to complete a tas