Policies, Standards, Procedures, and Guidelines
Every governance program rests on a hierarchy of documents. At the top, policies state management's intent in broad strokes; standards make those intentions measurable; procedures spell out the exact steps; and guidelines offer recommended-but-optional advice. When I coach GRC analysts, I tell them to ask one question about any document: is compliance mandatory, and how specific is it? That instantly places the document in the hierarchy.
| Document | Mandatory? | Level of detail | Example |
|---|---|---|---|
| Policy | Yes | High-level intent | "All corporate data must be encrypted at rest." |
| Standard | Yes | Specific, measurable | "Use AES-256 for data at rest." |
| Procedure | Yes | Step-by-step | "To enable BitLocker: open Manage BitLocker, click Turn On..." |
| Guideline | No (recommended) | Flexible advice | "Consider a passphrase of four random words." |
Guideline — A recommended, non-mandatory practice that helps people meet policy goals when no strict standard applies. Guidelines allow judgment; standards do not.
Exam tip: On the exam, watch the verbs. "Must" and "shall" signal a policy or standard; "should" or "consider" signals a guideline. If the document lists numbered steps, it is a procedure.
Don't confuse: Classic confusion: a password policy says strong passwords are required; the password standard defines the exact length and complexity. Exam questions often blur these — pick the answer that matches the level of detail described in the stem.
Policy — A high-level, mandatory statement of management intent that defines what must be achieved and who is accountable, deliberately leaving out technical specifics so it survives technology changes.
In practice the hierarchy is a chain you should be able to trace in either direction. Start from a policy statement like "all remote access must be strongly authenticated" and walk down to a standard ("remote access requires phishing-resistant MFA") and then to a procedure ("how to enroll your security key in the identity portal"). When a GRC analyst investigates an audit finding, they walk the chain upward instead: a misconfigured server usually traces back to a missing or ambiguous standard, and a missing standard traces back to a policy nobody operationalized. If any link is missing, enforcement collapses into personal opinion — and audits notice.
The layering also controls how often each document changes, which is a deliberate design choice. Policies are stable and are reviewed perhaps annually because senior management (often the board) approves them. Standards change as technology evolves — a new approved cipher, a longer minimum key length. Procedures change most often, whenever a tool, vendor, or interface changes. This is why you never bake product names into a policy: you do not want to convene executives every time a vendor renames a menu.
A document states: "Wireless networks must use WPA3-Enterprise with 802.1X authentication." Which document type is this?
Which statement about guidelines is TRUE?