Security Policies & Procedures Development Flashcards

Which document type provides mandatory, specific technical requirements that support a high-level policy, such as minimum password length?

Answer: Standard

Standards define mandatory, measurable requirements that implement policy statements.

A security guideline differs from a security standard primarily because a guideline is:

Answer: Recommended or advisory rather than mandatory

Guidelines offer recommended practices and flexibility, whereas standards are compulsory.

Who should have final approval authority over an organization-wide information security policy?

Answer: Senior management or executive leadership

Executive approval demonstrates management commitment and gives the policy organizational authority.

What is the main purpose of a baseline in security documentation?

Answer: To define the minimum acceptable security configuration for a system type

A baseline establishes a minimum consistent security level against which systems are measured.

Which element of a well-formed policy states who is covered by it?

Answer: Scope

The scope section identifies the people, systems, and data to which the policy applies.

Policies should generally be written to remain valid even when technology changes. This is best achieved by:

Answer: Keeping policy statements technology-neutral and placing details in standards and procedures

Technology-neutral policies stay stable while lower-level documents absorb technical change.

Which of the following is a procedure rather than a policy?

Answer: Step-by-step instructions for revoking a terminated employee's system access

Procedures provide detailed, sequential steps for carrying out a task.