A mayor demands a one-page 'encryption policy' that also lists exact cipher suites. How should the security manager separate the document types?
Select an answer to reveal the explanation.
Short Explanation
Policy is the 'why and what' from leadership — encrypt sensitive data. Standards are the 'must use these suites' details that engineers follow. Cramming cipher lists into a one-page policy mixes the altitude levels and ages poorly when crypto guidance changes.
Full Explanation
Policies state directive intent—what must be achieved and why—while standards capture mandatory technical criteria such as approved cipher suites. When a mayor wants a one-page encryption policy that also lists exact suites, the security manager should keep the policy at intent level and place mandatory cipher-suite criteria in a standard. That separation keeps executive direction stable when cryptographic guidance changes and gives engineers a precise, updateable mandate.
Putting cipher suites in the policy and leaving standards empty forces executives to rubber-stamp volatile technical detail and ages the policy poorly. Calling every document a guideline so nothing is mandatory removes enforceability. Publishing cipher suites only on a sticky note under a keyboard fails change control, distribution, and auditability.
Exam caveat: Policy / standard / guideline / procedure altitude questions are frequent. Policies = direction; standards = mandatory specifics; guidelines = advice; procedures = steps.
Operational check: Draft a short encryption policy on outcomes (protect classified data in transit/at rest), publish a crypto standard with approved algorithms and suite lists, version-control both, and review the standard when NIST or vendor guidance changes without rewriting board policy.