A security team publishes a document that recommends, but does not require, that developers follow a published hardening benchmark when building short-lived test environments. Which type of governance artifact is this document?
Select an answer to reveal the explanation.
Short Explanation
Here's the easy tell: standards say 'must', guidelines say 'should'. If the document recommends rather than requires, you're looking at a guideline. The trap is that it mentions a benchmark, which sounds like a standard, but the optional wording decides it.
Full Explanation
Governance artifacts differ mainly in how binding they are. A guideline offers recommended practice and leaves room for judgment; the 5.1 guideline category explicitly includes benchmarks, advisories, implementation guides, and reference architectures. When a document recommends a hardening benchmark but does not require it, it is functioning as a guideline. A standard is mandatory and specific, such as a required password length or a baseline configuration every server must meet; the moment compliance is required and measured, the same benchmark content becomes a standard. A procedure describes how to accomplish a task step by step, such as a standard operating procedure or runbook; this document does not prescribe steps, it recommends a reference source. A policy is a high-level, management-approved statement of intent and authority, such as an information security or acceptable use policy; it is binding and broad rather than optional and technical. Exam caveat: the same content can be a guideline in one organization and a standard in another, so the deciding factor in a question is whether the wording is advisory or mandatory. Operational check: read the document's language for must or shall versus should or may, and confirm whether noncompliance triggers an exception process; if no exception is needed, it is a guideline.