Defensive Security Handbook, 2nd Edition

Chapter 4. Standards and Procedures

Over time, organizations can accumulate a large amount of documentation. It can be helpful to organize this into a hierarchy, as illustrated in Figure 4-1. Standards and procedures are two sets of documentation that support the policies and bring them to life. In this chapter we will discuss what standards and procedures are, how they relate to policies, and what they should contain.

Figure 4-1. The documentation hierarchy

If we consider the policies of an organization to be the “why” we are trying to achieve, standards and procedures form the “what” and “how.” Like policies, standards and procedures bring many advantages, including:

Consistency

Worries about the nuances of the implementation of policies at a technology level are removed when consistency is applied. Having a written set of standards and procedures ensures that the rules outlined in the policies can be applied equally across the organization.

Distribution of knowledge

As mentioned in the previous chapter, it’s all well and good for you to know how to implement your policies in practice; however, if those elsewhere in the organization are unaware of this, they won’t provide much benefit. Standards and procedures disseminate this information for others to consume. Organizations often make the mistake of relying on institutional or legacy knowledge, which over time can ...