Security Program Management and Oversight · Topic 1 of 7
Governance Policies, Standards and Procedures
Security+ GRC artifacts: guidelines, standards, procedures, runbooks, continuity plans and the ten policy types, from AUP and BYOD to data disposal.
- 5 min
- Policies set intent, standards set measurable requirements, procedures give steps and guidelines are optional advice.
- Benchmarks, advisories, implementation guides and reference architectures are guidelines.
- Baselines, password, physical security, encryption standards and RFCs are standards.
What it is
Governance, risk and compliance (GRC) artifacts are the written documents that direct a security program. They say what must be protected, which settings are required, how tasks are done and what to do when things go wrong.
The exam asks you to tell five kinds of artifact apart: policies, standards, procedures, guidelines and plans. Each has a different purpose and a different level of authority.
How it works
The five artifact types
| Artifact | Purpose | Mandatory? |
|---|---|---|
| Policy | High level statement of intent and rules, approved by management | Yes |
| Standard | Specific, measurable requirement that supports a policy | Yes |
| Procedure | Step by step instructions for a task | Yes, for that task |
| Guideline | Recommended practice and advice | No |
| Plan | What to do in a defined situation, such as an outage or disaster | Yes, when the situation occurs |
A policy says that data must be protected. A standard says which encryption strength to use, a procedure shows how an administrator enables it, and a guideline offers tips.
Guidelines
| Guideline | Meaning |
|---|---|
| Benchmarks | Recommended secure settings for a product, such as the CIS Benchmarks from the Center for Internet Security |
| Advisories | Notices about a vulnerability or threat and the advised fix, published by vendors or agencies |
| Implementation guides | Instructions for deploying a product securely, often from the vendor |
| Reference architecture | A proven design pattern that shows how components should fit together securely |
Guidelines are advice, but an organization often adopts a benchmark and turns it into a mandatory standard or baseline.
Standards
| Standard | Covers |
|---|---|
| Baselines | The minimum approved configuration for a type of system |
| Passwords | Length, complexity, reuse and storage requirements |
| Physical security | Required locks, badges, cameras and visitor controls |
| Request for comments (RFC) | Documents published by the Internet Engineering Task Force (IETF) that define internet protocols |
| Encryption | Approved algorithms, key lengths and where encryption must be used |
An RFC is a public technical standard rather than an internal one. For example, TLS 1.3 is defined in RFC 8446, so an encryption standard can require protocols that follow it.
Procedures
A standard operating procedure (SOP) gives the routine, repeatable steps for a task, such as creating a user account. A runbook gives the steps for a specific operational event, such as restarting a failed service or isolating an infected host, and is often partly automated.
Plans
| Plan | Purpose |
|---|---|
| Business continuity plan (BCP) | Keeps critical business functions running during a disruption |
| Disaster recovery plan (DRP) | Restores IT systems and data after a disaster |
Continuity is about the business carrying on. Disaster recovery is the technical part that brings systems back.
Policies
| Policy | Covers |
|---|---|
| Bring your own device (BYOD) | Rules for using personal devices for work, such as enrollment and remote wipe of company data |
| Acceptable use policy (AUP) | What users may and may not do with company systems |
| Clean desk | Sensitive papers and devices locked away when a desk is unattended |
| Information security | The overall rules and responsibilities for protecting information |
| Incident response | How incidents are reported, handled and reviewed |
| Data classification and retention | How data is labeled and how long each class is kept |
| Access control | How access is requested, approved, granted and reviewed |
| Data disposal | How data and media are securely destroyed when no longer needed |
| Vulnerability disclosure | How outside researchers may report flaws and how the organization responds |
| Privacy | How personal data is collected, used, shared and protected |
How the exam asks about this
- "An administrator needs exact steps to restore a failed mail server." -> A runbook.
- "The company adopts the CIS settings for its Windows servers as the minimum build." -> A baseline standard based on a benchmark.
- "A researcher wants to know how to report a flaw in the company website." -> The vulnerability disclosure policy.
What to remember for the exam
- Policies set intent, standards set measurable requirements, procedures give steps and guidelines are optional advice.
- Benchmarks, advisories, implementation guides and reference architectures are guidelines.
- Baselines, password, physical security, encryption standards and RFCs are standards.
- An SOP covers routine tasks. A runbook covers a specific operational event.
- A BCP keeps the business running, and a DRP restores IT systems.
- An AUP defines allowed behavior on company systems.
- A clean desk policy protects papers and devices left unattended.
- A data disposal policy covers secure destruction of data and media.
When a question asks which document tells an administrator exactly how to perform a task, the answer is a procedure, such as an SOP or runbook.
Common mistakes
Mixing up policy and standard. A policy states the rule in general terms, while a standard gives the specific value or technology.
Treating guidelines as required. They are recommendations, unless the organization formally adopts them as a standard.
Confusing BCP and DRP. Continuity keeps the business working. Disaster recovery restores the technology.
Treating an RFC as a company document. An RFC is a public internet standard from the IETF.
Writing a policy and never reviewing it. Policies need regular review as the law, technology and business change.
A policy without management support or enforcement is just a document. Governance needs authority and follow up.
Check yourself
Which governance artifact is optional advice?
A guideline, such as a benchmark or implementation guide.
What is the difference between an SOP and a runbook?
An SOP gives steps for a routine task, while a runbook gives steps for responding to a specific operational event.
Which policy covers how outside researchers report security flaws?
The vulnerability disclosure policy.
Topic 1 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.