thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Governance, Risk, Audit & Privacy

Policy vs Standard vs Procedure: What's the Difference?

A policy is a high-level, mandatory statement of management intent. A standard defines specific mandatory requirements that support the policy, and a procedure gives step-by-step instructions for carrying out a task. Guidelines, by contrast, are optional recommendations.

vs

Standard

vs
PolicyStandardProcedure
LevelStrategic, high levelTactical, specificOperational, detailed steps
Mandatory?YesYesYes
Approved bySenior management/boardManagement or security functionProcess owners
Change frequencyRarelyOccasionally, as technology changesOften
ExampleAll sensitive data must be encryptedUse AES-256 for data at restSteps to enable BitLocker on a laptop
Remember it

Policy says why, standard says what, procedure says how.

Exam tip

If the item is optional, it is a guideline. If it specifies a technology or configuration requirement, it is a standard. Baselines define a minimum security configuration level.

Tested on

More Governance, Risk, Audit & Privacy look-alikes