Certopolis

CompTIA Security+ (SY0-801)

Policy vs standard vs procedure vs guideline: Security+ explained

A policy states management's direction at a broad level. A standard makes a specific technology or setting compulsory across the organization. A procedure gives detailed steps for a task, and a guideline gives recommendations that can be applied correctly in more than one way.

Policy

NIST SP 800-12 Rev. 1 sorts policy into three types. Program policy creates the information security program, sets its strategic direction, assigns resources and assigns responsibility for implementing it. A management official, typically the senior information security officer, issues it.

Issue-specific policy covers a topic of current concern, such as internet access, and tells employees how to use systems properly. It is reviewed regularly because technology changes. System-specific policy applies to one system.

Standards, guidelines and procedures

Policy is written at a broad level, so organizations also write standards, guidelines and procedures to show how to meet it.

Organizational standards specify uniform use of specific technologies, parameters or procedures where that uniformity benefits the organization. SP 800-12's example is a single organization-wide identification badge, which makes it easy for employees to move between sites and for entry systems to be automated. Standards are normally compulsory. Requiring one approved encryption algorithm and minimum key length in every department is a standard.

Guidelines help people secure their systems while accepting that systems vary and that imposing a standard is not always achievable, appropriate or cost-effective. They help make sure security measures are not overlooked, and they can be implemented correctly in more than one way.

Procedures describe how to implement policies, standards and guidelines. They are detailed steps for a particular task. SP 800-12's example is preparing new user accounts and assigning the appropriate privileges.

How to tell them apart in a question

Ask what the document does. Sets direction and assigns responsibility: policy. Requires one specific setting or technology everywhere: standard. Lists the steps to do one task: procedure. Recommends, and allows more than one correct way: guideline.

Where the exam catches people

  • Believing a guideline is mandatory: standards are normally compulsory; guidelines recognize that systems vary and can be met in more than one way.
  • Believing a required algorithm and key length is a policy: a specific, uniform, compulsory requirement is a standard.
  • Believing a procedure and a standard are interchangeable: a procedure gives step-by-step instructions for a task; a standard states what must be used.
  • Believing every policy is high-level program policy: issue-specific policies cover particular topics and need regular review.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. An organization requires every department to use the same approved encryption algorithm and minimum key length for stored data. Which of the following governance artifacts does this requirement represent?

    Right. In the game that’s Renown for your Security Program Management and Oversight building.

    Not that one: C is right. In the game your Security Program Management and Oversight building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    A required algorithm and minimum key length for every department fits that description.

    Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf

  2. A security team publishes laptop hardening recommendations that acknowledge device configurations vary and that each recommendation can be correctly implemented in more than one way. Which of the following best describes this document?

    Right. In the game that’s Renown for your Security Program Management and Oversight building.

    Not that one: A is right. In the game your Security Program Management and Oversight building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    It also says guidelines can be implemented correctly in more than one way. Standards, by contrast, are normally compulsory within an organization.

    Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf

  3. Which of the following governance artifacts gives staff detailed steps for a particular task, such as preparing new user accounts and assigning the appropriate privileges?

    Right. In the game that’s Renown for your Security Program Management and Oversight building.

    Not that one: B is right. In the game your Security Program Management and Oversight building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    They are detailed steps followed by users or system operations personnel to accomplish a particular task, and its example is preparing new user accounts and assigning the appropriate privileges.

    Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf