A document states that all user passwords must be at least 14 characters long and must be changed if compromise is suspected. It applies to every system and does not describe how to configure any system. How should this document be classified?
Select an answer to reveal the explanation.
Short Explanation
Policy says 'protect accounts,' the standard says 'here's the exact bar,' and the procedure says 'click here, then here.' A specific mandatory minimum length you've got to meet is the standard, and the trap is calling it a policy just because it's mandatory.
Full Explanation
The documentation hierarchy distinguishes purpose and level of detail. Policies express management's intent and high-level direction, such as a requirement to control access to information. Standards set specific, mandatory requirements that support policies, such as a minimum password length and a rule to change passwords on suspected compromise. Procedures describe step-by-step how to perform tasks, and guidelines offer recommended but optional practices. The document described sets specific mandatory requirements without configuration steps, which makes it a standard. Calling it a policy because it applies to every system overlooks that scope does not define a policy, and standards are mandatory organization-wide too; what separates a policy is its high-level intent, whereas this document specifies measurable parameters. Calling it a procedure misreads its content; it states what must be achieved, not the steps to achieve it on each system, and the stem notes it contains no configuration instructions. Calling it a guideline ignores that its requirements are mandatory; guidelines are advisory. Exam caveat: some organizations embed standards inside policy documents, but on the exam the function of the content determines its type. Operational check: confirm the document references the policy it supports, is owned and approved as a standard, and is implemented by system-specific procedures.