Public-works IT must enforce measurable password length, MFA for remote access, badge requirements for server rooms, and approved encryption algorithms. Which artifact type sets those mandatory specifics?
Select an answer to reveal the explanation.
Short Explanation
Standards are the measurable yardsticks—password length, MFA, badge rules, allowed crypto—that public-works must meet. Guidelines can suggest; standards say “this is required.” Slogans and unread vendor blogs do not create enforceable baselines.
Full Explanation
Security standards translate high-level policy into mandatory, testable baselines. Public-works IT needs enforceable specifics: minimum password length, MFA for remote access, badge requirements for server rooms, and approved encryption algorithms. Those requirements belong in standards (sometimes paired with technical configuration baselines) so assessors can measure compliance and engineers know exactly what “secure enough” means. Standards carry obligation; they are not casual advice. They sit beneath policy and above procedures: policy says protect access, standards say MFA and twelve-character passwords, procedures say how to enroll a token.
Informal hallway guidelines with no enforcement expectation lack mandatory force and cannot reliably drive architecture or audits. Optional vendor blog posts are external commentary until formally adopted—and even then they rarely replace internal standards. Marketing slogans about “being secure” create no measurable control. Exam caveat: when the stem lists measurable mandatory controls (password, MFA, badges, algorithms), the artifact type is standards. Operationally, publish public-works security standards with version control, map each requirement to policy, verify with configuration scans and physical checks, and update standards when cryptography guidance or access architecture changes—not via hallway consensus alone.