CompTIA Security+ Preparation · lesson 3 of 45 · 25 min
The Policy Hierarchy
Security governance relies on a hierarchy of documents that flow from high-level intent down to specific instructions. Understanding the differences is a frequent Security+ exam topic.
Policy — a high-level statement of management intent and direction. Mandatory. Sets the “what” and “why.” Example: “All company data must be encrypted at rest and in transit.” Approved by senior leadership.
Standard — specific mandatory requirements that support a policy. Sets the “how” at a technical level. Example: “AES-256 must be used for data at rest; TLS 1.2 or higher for data in transit.” More specific than a policy.
Procedure — step-by-step instructions for implementing a standard. Example: “To encrypt a new server: 1. Install BitLocker. 2. Generate a recovery key. 3. Store the key in the key management system.” Mandatory.
Guideline — recommended best practices. NOT mandatory — provides flexibility. Example: “Consider using a password manager for personal accounts.” Advisory only.
Baseline — minimum security configuration for a system type. Example: “All Windows workstations must meet the CIS Level 1 benchmark.” Mandatory.
Common Security Policies
Acceptable Use Policy (AUP) — defines permitted and prohibited uses of company systems and networks. All employees must sign. Covers internet use, email, software installation, personal use.
Password Policy — minimum length, complexity, expiration, history, lockout thresholds.
Data Classification Policy — defines sensitivity levels (Public, Internal, Confidential, Restricted) and handling requirements for each.
Incident Response Policy — defines roles, responsibilities, and procedures for responding to security incidents.
Remote Access Policy — requirements for VPN use, MFA, device compliance before accessing corporate resources remotely.
Clean Desk Policy — physical security policy requiring employees to secure sensitive documents and lock screens when away from their desk.
BYOD Policy — rules for personal devices accessing corporate resources: MDM enrollment, acceptable apps, remote wipe consent.
Key Terms
Key Terms
Knowledge Check — 12 Questions
Security+ — Policies & Governance
Which document is NOT mandatory?
- Policy
- Standard
- Guideline
- Procedure
Answer: Guideline
Guidelines are recommended best practices — they are advisory, not mandatory. Policies, standards, and procedures are all mandatory.
A policy stating “All data must be encrypted” is supported by a standard that says “Use AES-256.” The standard is:
- More general than the policy
- More specific than the policy
- Optional
- A guideline
- Answer: More specific than the policy
Standards provide specific technical requirements that implement the high-level policy intent. An Acceptable Use Policy (AUP) is signed by:
- Only IT staff
- Only managers
- All employees
- Only contractors
- Answer: All employees
AUPs apply to all users of company systems — employees, contractors, and sometimes vendors. A clean desk policy is primarily a:
- Technical control
- Physical security control
- Administrative control
- Compensating control
- Answer: Physical security control
Clean desk policies protect physical documents and prevent shoulder surfing — a physical/operational security control.
Which document provides step-by-step instructions for a specific task?
- Policy
- Standard
- Guideline
- Procedure
Answer: Procedure
Procedures are step-by-step instructions for implementing standards — the most specific mandatory document type.
A baseline defines the minimum acceptable security configuration for a system type.
- True
- False
Answer: True
Baselines (e.g., CIS benchmarks) define the minimum security configuration — all systems of that type must meet or exceed it.
A BYOD policy should include:
- Only password requirements
- MDM enrollment, acceptable apps, and remote wipe consent
- Only encryption requirements
- Only VPN requirements
- Answer: MDM enrollment, acceptable apps, and remote wipe consent
BYOD policies must address device management (MDM), permitted applications, and the ability to remotely wipe corporate data. Data classification levels typically include (from least to most sensitive):
- Public, Internal, Confidential, Restricted
- Restricted, Confidential, Internal, Public
- Top Secret, Secret, Confidential, Unclassified
- Level 1, Level 2, Level 3, Level 4
- Answer: Public, Internal, Confidential, Restricted
Common commercial classification: Public (anyone can see), Internal (employees only), Confidential (limited access), Restricted (highest sensitivity).
Which policy defines requirements for accessing corporate resources from home?
- AUP
- Clean desk policy
- Remote access policy
- Data classification policy
Answer: Remote access policy
Remote access policies specify VPN requirements, MFA, device compliance checks, and approved methods for remote work.
The document hierarchy from most general to most specific is: Policy → Standard → _____ → Guideline (optional).
Answer: Procedure
Procedures are the most specific mandatory documents — step-by-step instructions implementing standards.
An incident response policy defines:
- Specific encryption algorithms
- Roles, responsibilities, and procedures for security incidents
- Password complexity requirements
- Acceptable internet usage
- Answer: Roles, responsibilities, and procedures for security incidents
IR policies establish who does what during an incident — roles, escalation paths, communication requirements, and response procedures.
Which is an example of a standard (not a policy)?
- “All data must be protected”
- “Use AES-256 for data at rest and TLS 1.3 for data in transit”
- “Consider using a password manager”
- “Step 1: Enable BitLocker. Step 2: Store the recovery key.”
Answer: “Use AES-256 for data at rest and TLS 1.3 for data in transit”
Standards specify the technical “how” — specific algorithms, versions, and configurations that implement the policy.
Previous lesson: Security frameworks: NIST CSF, ISO 27001, CIS Controls
Back to CompTIA Security+ Preparation
Next lesson: Change management and configuration management in security