A newly established fintech firm is defining its formal security governance architecture to ensure consistent risk oversight across cloud services. Match each governance document type on the left with its corresponding operational characteristic on the right.
- Security PolicyHigh-level, mandatory directive that outlines organizational security goals and management intent
- Security StandardMandatory requirement specifying technologies, protocols, or concrete operational rules to enforce policy objectives
- Security BaselineMinimum mandatory operational configuration benchmark established for a specific system type or asset class
- Security GuidelineDiscretionary recommendation providing non-mandatory best practices and operational advice
Answer
Security Policy pairs with the high-level mandatory directive outlining security goals; Security Standard pairs with the mandatory requirement specifying technical controls and operational rules; Security Baseline pairs with the minimum mandatory operational configuration benchmark; Security Guideline pairs with the discretionary recommendation providing best practices.
The correct pairings accurately place documents in the governance hierarchy: Security Policy serves as the executive mandatory directive; Security Standard sets mandatory operational and technical rules; Security Baseline establishes the mandatory minimum configuration benchmark for target assets; and Security Guideline offers optional best-practice advice.
Step-by-Step Solution
Key Concept
Security Governance Document Hierarchy and Enforcement Levels