An enterprise security governance team is reviewing its information security documentation hierarchy to resolve audit findings regarding governance ambiguity. Match each governance document type on the left with its corresponding organizational characteristic and legal/enforcement property on the right.
- Security PolicyExecutive-approved mandatory directive defining high-level strategic goals, authority, roles, and risk tolerance across the organization.
- Security StandardMandatory technical requirement establishing specific compulsory rules, metrics, or cryptographic parameters needed to meet policy goals.
- Security BaselineMinimum compulsory operational configuration state required for specific hardware, operating systems, or cloud images prior to production.
- Security GuidelineNon-mandatory operational advisory offering recommended best practices and flexible suggestions to assist staff in decision-making.
Cevap
Security Policy matches executive-approved strategic directives; Security Standard matches mandatory technical rules and metric parameters; Security Baseline matches minimum compulsory hardening settings for specific systems; Security Guideline matches non-mandatory recommended operational advice.
Each governance document type fulfills a distinct role in the governance framework hierarchy: Security Policy sets mandatory strategic intent; Security Standard defines compulsory technical specifications; Security Baseline sets mandatory minimum build states for platforms; and Security Guideline offers non-binding advice.
Adım Adım Çözüm
Anahtar Kavram
Security Governance Documentation Hierarchy (Policy, Standard, Baseline, Guideline)
Tahmini Süre:2m 0s