Policies, Standards, Guidelines, and Procedures
Policies, standards, guidelines, and procedures are all subtly different from each other, but they also interact with each other in a variety of ways. It’s your job as a CISSP candidate to study these differences and relationships, and also to recognize the different types of policies and their applications. To successfully develop and implement information security policies, standards, guidelines, and procedures, you must ensure that your efforts are consistent with the organization’s mission, goals, and objectives (see the preceding sections).
Policies, standards, guidelines, and procedures all work together as the blueprints for a successful information security program. They
Establish governance.
Provide valuable guidance and decision support.
Help establish legal authority.
Too often, technical security solutions are implemented without these important blueprints. The results are often expensive and ineffective controls that aren’t uniformly applied and don’t support an overall security strategy.
Governance is a term that collectively represents the system of policies, standards, guidelines, and procedures that help steer an organization’s day-to-day operations and decisions.
Policies
A security policy forms the basis of an organization’s information security program. RFC 2196, The Site Security Handbook, defines a security policy as “a formal statement of rules by which people who are given access to an organization’s technology and information assets must abide.”
The four main types of policies are
Senior Management: A high-level management statement of an organization’s security objectives, organizational and individual responsibilities, ethics and beliefs, and general requirements and controls.
Regulatory: Highly detailed and concise policies usually mandated by federal, state, industry, or other legal requirements.
Advisory: Not mandatory, but highly recommended, often with specific penalties or consequences for failure to comply. Most policies fall into this category.
Informative: Only informs, with no explicit requirements for compliance.
Standards, guidelines, and procedures are supporting elements of a policy and provide specific implementation details of the policy.
ISO/IEC 27002 (formerly ISO 17799), Information Technology — Security Techniques — Code of Practice for Information Security Management, is an international standard for information security policy originally based on BS (British Standard) 7799. ISO/IEC is the International Organization for Standardization and International Electrotechnical Commission. ISO/IEC 27002 consists of 12 sections that largely (but not completely) overlap the ten (ISC)2 security domains.
Standards (and baselines)
Standards are specific, mandatory requirements that further define and support higher-level policies. For example, a standard may require the use of a specific technology, such as a minimum requirement for encryption of sensitive data using 3DES. A standard may go so far as to specify the exact brand, product, or protocol to be implemented.
Baselines are similar to and related to standards. A baseline can be useful for identifying a consistent basis for an organization’s security architecture, taking into account system-specific parameters, such as different operating systems. After consistent baselines are established, appropriate standards can be defined across the organization.
Guidelines
Guidelines are similar to standards but they function as recommendations rather than as compulsory requirements. For example, a guideline may provide tips or recommendations for determining the sensitivity of a file and whether encryption is required.
Procedures
Procedures provide detailed instructions on how to implement specific policies and meet the criteria defined in standards. Procedures may include Standard Operating Procedures (SOPs), run books, and user guides. For example, a procedure may be a step-by-step guide for encrypting sensitive files by using a specific software encryption product.