Security Governance
The document hierarchy
Policies state management intent, are mandatory and high level ("access must follow least privilege"). Standards are mandatory specifics ("passwords are at least 14 characters"). Procedures are mandatory step-by-step instructions for a task. Guidelines are recommended but optional. Questions love to test that guidelines are not mandatory and that policies originate with senior management rather than IT alone.
Accountability and data roles
Senior management owns risk and is ultimately accountable; it approves policy and accepts residual risk. The CISO and security team advise and operate the program. Data owners (business managers) classify data and decide who may access it; data custodians (IT) implement the controls; users follow the rules. Regulations such as GDPR, HIPAA, PCI DSS and SOX are drivers and obligations, not substitutes for a risk-based program - PCI DSS applies to any organization handling card data regardless of size.
Resilience and third parties
A business impact analysis identifies critical processes and produces the maximum tolerable downtime (MTD), from which you derive the recovery time objective (RTO - how fast service must return) and the recovery point objective (RPO - how much data loss, measured in time, is tolerable). Vendor risk management applies due diligence before contracting and right-to-audit clauses afterward.
Rule of thumb
Match the document to its language: high-level "must" = policy; "must" with numbers or product specifics = standard; "should" = guideline; a numbered task sequence = procedure. For outages, if the question measures lost transactions it is asking about RPO; if it measures time to restore, RTO.