An enterprise energy grid operator is restructuring its security governance documentation hierarchy. Match each governance document type on the left with its corresponding operational and enforcement characteristic on the right.
- Security PolicyHigh-level executive mandate establishing security objectives, organizational scope, and governance roles without specifying technical implementations.
- Security StandardCompulsory technical requirement that specifies exact technologies, protocols, or operational controls that must be uniformly implemented.
- Security BaselineMinimum required security configuration benchmark that systems must satisfy before being approved for operational deployment.
- Security GuidelineDiscretionary recommendation and operational best practice that provides advice when no strict mandatory rule applies.
Answer
Security Policy matches the high-level executive mandate; Security Standard matches the compulsory technical requirement; Security Baseline matches the minimum required configuration benchmark; Security Guideline matches the discretionary recommendation.
In formal security governance, documents are categorized by scope and enforcement authority. Security Policies set executive intent and broad goals. Security Standards define mandatory requirements and mandatory technical specs. Security Baselines define the minimum required hardening state for systems prior to production release. Security Guidelines provide voluntary advice and best practices for staff.
Step-by-Step Solution
Key Concept
Security Governance Documentation Hierarchy and Enforcement Levels