Skip to main content

Security Policies and Standards

Policies define what the organization requires. Standards define how those requirements are met. Procedures define who does what, when. Together they are the documented expression of the security program. Policies without standards are vague; standards without procedures are unenforceable; procedures without policies lack authority. The three work together.

Files​

#FileFormat
01Policy FundamentalsProcess-based
02Policy Hierarchy and ArchitectureProcess-based
03Standards and BaselinesProcess-based
04Policy Lifecycle and GovernanceProcess-based
05Policy Enforcement and ExceptionsProcess-based

Certification Alignment​

This subcategory maps to the following certifications:

  • CISSP - Domain 1 (Security and Risk Management): policies, standards, procedures, guidelines.
  • CISM - Domain 1 (Information Security Governance): policy framework, governance.
  • CISA - Domain 5 (Protection of Information Assets): policy design and implementation.
  • ISO 27001 LI/LA - Clause 5.2 (Information security policy), Annex A.5.1 (Policies for information security).

See ../../CERTIFICATIONS.md for the full matrix.

References​