The Difference Between Policies Standards Guidelines and Procedures
One of the more confusing elements of security policies is the interaction between policies, standards, guidelines, and procedures. First, let's define what we mean by each:
- Policy A policy is a document that outlines the requirements or rules that must be met. Policies frequently refer to standards or guidelines as the basis for the existence. The scope of a policy tends to be a broad, high level statement of intent. An example of a policy is an Encryption Use Policy, which might state to the effect of "encryption should be used in these circumstances."
- Standard A standard is a set of requirements, typically system or technology specific, that must be adhered to by everyone. The scope of a standard tends to be to specify the requirements about a given technology or area. An example might be defining that the only acceptable encryption algorithms are Triple DES (3DES) or Advanced Encryption Standard (AES).
- Guideline A guideline is similar to a standard, but it differs in that unlike a standard, a guideline is merely a recommendation or suggestion that should probably be followed but is not necessarily required. Guidelines and standards are largely interchangeable in most cases.
- Procedure A procedure defines the process that is followed to meet the requirements of a policy, standard, or guideline. The scope of a procedure is the specific step-by-step processes and procedures that should be followed for implementing a given standard or guideline. An example of this might be defining the procedures required to implement 3DES or AES encryption on your firewalls.
Figure 10-2 helps to illustrate the relationship between policies, standards, and procedures as a pyramid. Keep in mind that standards and guidelines are interchangeable and occupy the same level in the pyramid. As you go down the
pyramid, the documents get more detailed and are more subject to change. So, policies are broad and do not change often. Standards and guidelines are more detailed but more susceptible to change. Procedures are extremely detailed and may frequently change as they incorporate new standards or methods of performing the given tasks.
Figure 10-2. Policies, Standards, and Procedures Pyramid

Continue reading here: Ingress Filters
Was this article helpful?
Readers' Questions
-
Cindy2 months ago
- Reply
-
T2 months ago
- Reply
-
rosa oldbuck2 months ago
- Reply
-
Marianna10 months ago
- Reply
-
Ramsay10 months ago
- Reply
-
jere10 months ago
- Reply
-
milo10 months ago
- Reply
-
Mathias Traugott10 months ago
- Reply
-
LATOYA10 months ago
- Reply
-
NICOLE G10 months ago
- Reply
-
madoc sandyman1 year ago
- Reply
-
mentha boffin1 year ago
- Reply