A mayor demands a one-page 'encryption policy' that also lists exact cipher suites. How should the security manager separate the document types?
Select an answer to reveal the explanation.
Short Explanation
Policy is the 'why and what' from leadership — encrypt sensitive data. Standards are the 'must use these suites' details that engineers follow. Cramming cipher lists into a one-page policy mixes the altitude levels and ages poorly when crypto guidance changes.
Full Explanation
Policies express management's high-level directives and intent. Standards specify mandatory, measurable criteria that implement policy — such as approved cryptographic algorithms and cipher suites. Embedding rapidly changing technical mandates in a brief executive policy conflates layers; separating directive policy from detailed standards improves clarity, approval, and maintenance.