Information Security Policy, Standards, and Procedures
What this domain tests
Policy, standards, and procedures tests the document hierarchy and control of documented information: who approves, what is mandatory, how exceptions work, and how documents stay current.
Core rules
- Policy states intent and direction, approved by top management.
- A standard defines mandatory requirements, such as password length or encryption algorithms.
- A procedure gives step-by-step instructions for a task.
- A guideline is recommended, not mandatory.
- ISO/IEC 27001 clause 7.5 requires documented information to be available, protected, version-controlled, and reviewed.
- Exceptions need documented risk acceptance, approver, scope, expiry, and compensating controls.
- Communication and training must reach affected roles; acknowledgement alone is not effectiveness.
Worked example
A company wants remote access. The policy says remote access is permitted only through approved methods to protect company information. The standard says MFA is required and split tunneling is prohibited. The procedure explains how to request access, install the client, and report a lost device. A guideline recommends a privacy screen. An exception for a legacy vendor is approved for 90 days by the CISO with network segmentation as compensation. Reasoning: each layer has a different job; the exception is time-bound and risk-accepted.
Traps
- Writing procedures inside policy.
- Providing no exception route, which pushes workarounds underground.
- Letting uncontrolled copies circulate.
- Treating annual review as a calendar exercise rather than a content check.
- Treating guidelines as auditable mandatory requirements.