What is the difference between a security policy and a baseline standard?

What is the difference between a security policy and a baseline standard?

• A. Policy is a plan for a single procedure.
• B. Standard is the overall security posture.
• C. Policy defines minimum requirements.
• D. Policy sets intent; standard defines minimum requirements and procedures to meet policy.

Answer: (D)

Policy sets management intent and broad security goals for the organization, while a baseline standard translates that intent into concrete, minimum requirements and the procedures needed to meet them. This means policy tells you what must be achieved in general, and the standard provides the exact rules, controls, and steps to implement it in practice. For example, a policy might require protecting data, and the standard would specify encryption algorithms, key management rules, and password requirements to actually enforce that protection. The idea that policy is only a plan for a single procedure is too narrow, and the notion that a standard is the overall security posture confuses outcomes with prescriptive rules. Also, assigning minimum requirements to policy misses how standards operationalize policy into concrete, enforceable requirements.

Policy sets management intent and broad security goals for the organization, while a baseline standard translates that intent into concrete, minimum requirements and the procedures needed to meet them. This means policy tells you what must be achieved in general, and the standard provides the exact rules, controls, and steps to implement it in practice. For example, a policy might require protecting data, and the standard would specify encryption algorithms, key management rules, and password requirements to actually enforce that protection. The idea that policy is only a plan for a single procedure is too narrow, and the notion that a standard is the overall security posture confuses outcomes with prescriptive rules. Also, assigning minimum requirements to policy misses how standards operationalize policy into concrete, enforceable requirements.