Security Policies and Procedures
Domain 5, Security Policies and Procedures, is about 15%. It tests governance vocabulary, the incident-response lifecycle, evidence handling, and the compliance obligations that shape an analyst's decisions.
Document hierarchy
- Policy: management's mandatory intent, such as access on least privilege.
- Standard: specific mandatory requirements, such as AES-256 or a 12-character minimum.
- Procedure: step-by-step instructions for a task.
- Guideline: recommended, not mandatory. Common policies cover acceptable use, access control, BYOD, data classification and retention, incident response, and business continuity and disaster recovery.
Roles and frameworks
Data owner is accountable for classification; data custodian operates the controls; users follow the acceptable-use policy. Compliance drivers include PCI DSS for cardholder data, HIPAA for protected health information, GDPR for EU personal data, and ISO/IEC 27001 for an information security management system. NIST SP 800-61 structures incident response as preparation; detection and analysis; containment, eradication and recovery; post-incident activity.
Evidence handling
Maintain chain of custody: who collected what, when, where, and every transfer, with hashes at acquisition. Use write blockers for disks; photograph and label; store in tamper-evident packaging. Follow order of volatility, memory before disk. A legal hold suspends normal deletion and retention schedules. Spoliation - destroying evidence - can be fatal to a case and to the analyst's credibility.
Worked example
An analyst confirms ransomware on a finance workstation. The quickest fix is reimaging. Policy says potential legal matters require evidence preservation, and the classification is confidential financial.
Reasoning: identify whether a legal hold applies; if yes, isolate the host from the network without powering it off, capture memory, image the disk with a write blocker, hash the images, and complete the custody form. Only then rebuild. Document the containment decision and notify per the escalation matrix. If no hold applies, the same capture still supports root-cause analysis and scoping.
Traps
- Calling a guideline mandatory.
- Rebuilding or rebooting before capture.
- Gaps in custody documentation.
- Treating compliance certification as proof of security.
- Retaining personal data indefinitely, contrary to privacy obligations.
- Verbal approvals with no record.