In an organization's information security governance structure, which element sets direction by stating management's intent and expectations?
Select an answer to reveal the explanation.
Short Explanation
Think of the governance documents as a chain of command. Policy is the general saying where the army is heading; standards, procedures and guidelines are everything that follows to get there. If you remember that policy is about intent and direction, the rest falls into place.
Full Explanation
In an information security documentation hierarchy, policy is the high-level statement of management's intent, direction and expectations. Policies are approved by senior management, change infrequently and provide the authority on which all other documents rest. Standards translate policy into mandatory, specific requirements, for example the minimum configuration for a class of systems or the required strength of authentication; they are binding but derive their authority from policy rather than setting direction themselves. Procedures describe the detailed steps for performing tasks in a way that complies with policy and standards; they are operational and change more frequently as tools and processes evolve. Guidelines provide recommendations and good practices that help people apply policy where there is room for judgment; they are not mandatory and therefore cannot set binding direction. Confusing these levels is a common source of problems, such as policies cluttered with technical detail that must be rewritten every time technology changes. Exam caveat: CISM expects policy to be technology-neutral and to express intent, with specifics left to subordinate documents. Operational check: review the document set to confirm that each standard, procedure and guideline references the policy it supports and that policies are approved by senior management.