An organization is updating its security governance hierarchy to resolve operational ambiguities discovered during a regulatory audit. Match each governance document type on the left with its corresponding organizational scope and enforceability characteristic on the right.
- Security PolicyHigh-level strategic mandate issued by senior leadership establishing compulsory security objectives and organizational expectations.
- Security StandardMandatory technical specs and configuration baselines required to achieve uniform, quantifiable compliance across enterprise systems.
- Security GuidelineDiscretionary recommendations and practical operational advice intended to guide decision-making without strict enforcement.
- Standard Operating ProcedureStep-by-step sequential instructions defining the exact technical actions required to complete specific operational tasks.
Cevap
Security Policy matches the high-level strategic mandate; Security Standard matches mandatory technical specs and configuration baselines; Security Guideline matches discretionary recommendations and operational advice; Standard Operating Procedure matches step-by-step sequential technical instructions.
Security governance relies on a defined hierarchy where Security Policies provide mandatory high-level strategic direction; Security Standards set compulsory technical configurations; Security Guidelines communicate non-mandatory suggestions; and Standard Operating Procedures provide explicit step-by-step execution tasks.
Adım Adım Çözüm
Anahtar Kavram
Information Security Governance Document Hierarchy