Security Policies, Procedures, and Standards
Domain 6 - Security Policies, Procedures, and Standards. This domain tests how written requirements govern behavior: the hierarchy from policy to standard to procedure to guideline, post orders, exception handling, training, audit, and alignment with life-safety and privacy obligations.
Core rules
- Policy states what and why; standards set mandatory requirements; procedures describe who does what, when, and how; guidelines are advisory. Mixing these levels creates unenforceable documents.
- Each policy needs an owner, approval authority, effective date, review cycle, and exception process. Post orders translate policy into shift-level duties.
- Align with applicable requirements: life-safety and egress codes such as NFPA 101, access control and intrusion system standards such as UL 294 and UL 1076, risk management frameworks such as ISO 31000, and privacy law for video and personal data.
- Control documents: version control, distribution, acknowledgment, training records, and audit evidence. Enforce through monitoring, not just publication.
- Exceptions must be risk-assessed, time-limited, approved, and recorded.
Worked example
An audit finds employees sharing badges. The policy prohibits sharing; the procedure defines temporary access and visitor badges; the system enforces anti-passback. Training explains the rule, and supervisors audit exceptions. The reasoning is that technology alone cannot fix a behavioral violation; policy, procedure, training, and enforcement must agree.
Traps
Writing a policy that conflicts with egress or fire requirements; publishing with no owner or review date; stating vague expectations that cannot be audited; and treating a standard as a step-by-step procedure.