ITPEC IP April 2020 Question 41

The procedures describe the specific steps to take under the rules in the standards — the three documents form a hierarchy, each one following the one above it.

• •Basic policy — top management's declaration of the organization's intent and direction for information security: what is protected and why. It is made known to all employees and, where needed, to outside parties.
• •Standards — the rules each department and person must follow to carry out the basic policy: what must be done.
• •Procedures — the concrete steps for each task or situation, written so that the person in charge can act in line with the standards: how to do it.

Answer (c)

Why not others:

• •(a) — reversed: the basic policy is set by management, and the standards and procedures are derived from it; employees follow the policy rather than write it
• •(b) — the basic policy states the overall direction, not the actions to take in an incident; incident-handling steps belong in the procedures
• •(d) — the standards sit below the basic policy and cannot define what it says; the policy is the top document, and the standards are built from it

Key rule: Read the policy set top-down: basic policy (why, by top management), standards (what must be done), procedures (how to do it); each lower level implements the one above.

Security · AI-written, may contain errors