CISSP Training Guide

Policies, Standards, Guidelines, and Procedures

Know how to set policies and how to derive standards, guidelines, and implement procedures to meet policy goals.

Part of information security management is determining how security will be maintained in the organization. Management defines information security policies to describe how the organization wants to protect its information assets. After policies are outlined, standards are defined to set the mandatory rules that will be used to implement the policies. Some policies can have multiple guidelines, which are recommendations as to how the policies can be implemented. Finally, information security management, administrators, and engineers create procedures from the standards and guidelines ...