An internal audit draft report cites a development team for not following the organization's secure coding guideline, which recommends but does not require certain practices. The team fully complied with the mandatory secure coding standard. How should the information security manager respond?
Select an answer to reveal the explanation.
Short Explanation
A guideline is a suggestion, like 'consider bringing an umbrella'; you can't be written up for walking in the rain. Since the team met the mandatory standard, you clarify that with the auditor rather than treating advice as a rule.
Full Explanation
Guidelines provide recommended practices to help people meet policies and standards, but by definition they are not mandatory. Compliance is measured against mandatory requirements, which here are set by the secure coding standard that the team fully met. The information security manager should therefore discuss the draft with the auditor, explain the status of the guideline in the documentation hierarchy, and ask that the finding be reconsidered; if a recommended practice is believed to be important, that can be raised as an improvement observation rather than noncompliance. Accepting the finding and mandating the guideline would effectively turn a recommendation into a requirement without the analysis and approval that standards need. Converting the guideline into a standard retroactively to validate the finding misuses the policy process; any change to mandatory requirements should be based on risk and approved properly, and it cannot make past conduct noncompliant. Requiring a formal exception implies the team breached a mandatory requirement, which it did not, and would misuse the exception process. Exam caveat: if risk analysis shows that a recommended practice should be mandatory, it should be elevated through governance. Operational check: confirm each document type in the policy framework is clearly labeled as mandatory or advisory.