An enterprise security organization is restructuring its internal governance documentation to align with ISO/IEC 27001 and NIST SP 800-53 standards. Match each formal security governance document type to the specific operational characteristic and enforcement authority that defines its role in the security program.
- Security PolicyHigh-level executive directive that establishes overall security posture, organizational scope, role assignments, and legal compliance obligations.
- Security StandardMandatory technical or operational specification dictating compulsory protocols, hardware configurations, or quantitative metrics.
- Security BaselineMinimum compulsory security configuration threshold required for a specific system or platform before deployment into production.
- Security GuidelineDiscretionary operational advice providing flexible recommendations and industry best practices without establishing strict compliance mandates.
Answer
Security Policy matches the high-level executive directive. Security Standard matches the mandatory technical specification. Security Baseline matches the minimum compulsory security configuration threshold. Security Guideline matches the discretionary operational advice.
Security Policies set high-level strategic direction from executive leadership; Security Standards define mandatory uniform technical controls; Security Baselines establish minimum system hardening configurations prior to deployment; and Security Guidelines provide advisory non-mandatory best practices.
Step-by-Step Solution
Key Concept
Security Governance Document Hierarchy and Enforcement Mechanisms