EXAM-004 - Policy vs Procedure vs Standard

Topic Summary

The exam may use policy, procedure, guideline, and standard loosely. Answer based on function, not title.

Key Concepts

• Policy: intent, direction, commitment, scope, accountability.
• Procedure: repeatable steps and responsibilities.
• Standard: mandatory rule or baseline.
• Guideline: recommended practice, usually flexible.

Common Exam Traps

• Thinking a policy must contain every operational detail.
• Treating guidelines as mandatory controls.
• Treating a procedure as evidence of management commitment by itself.

Related Notes

• Information Security Policy
• A.5.1 Policies for Information Security