Policy documentation
For the sake of simplicity policies, standards, procedures, and guidelines are collectively referred to as policy documentation:
- Policies: Policies are high-level statements of management intent from an organization’s executive leadership that are designed to influence decisions and guide the organization to achieve the desired outcomes.
Policies are enforced by standards and further implemented by procedures to establish actionable and accountable requirements.
Important note
Policies are a business decision, not a technical one. Technology determines how policies are implemented.
- Standards: Standards are mandatory requirements concerning processes, actions, and configurations that are designed to satisfy control objectives.
Standards are intended to be granular and prescriptive to establish minimum security requirements that ensure systems, applications, and processes are designed and operated to include appropriate...
