For the 350-701 exam objective about security policies, compliance, and governance, the first thing you need to understand is that security is not just about buying fancy firewalls. It is about creating a set of rules that everyone agrees to follow, and then actually checking that people stick to those rules. This matters because a single employee who ignores a simple password policy can open the door for a devastating cyberattack, no matter how expensive your security tools are.
Jump to a section
A simple way to picture Security Policies and Compliance
A senior building inspector is the central figure in this analogy. They are responsible for ensuring that every new construction project, from a garden shed to a skyscraper, meets the city’s safety codes, fire regulations, and accessibility standards. Before work even begins, they review the architect's plans to check that the design complies with the law. During construction, they make unannounced visits to verify that the builders are using approved materials and following proper procedures. If they find a serious violation, such as a missing fire escape or faulty wiring, they have the authority to issue a stop-work order, halting the entire project until the problem is fixed. This system protects everyone who will eventually live in or visit those buildings.
In the IT world, a security policy plays the same role as the city's building code. It is a formal document that lays out the rules, standards, and procedures that everyone in an organisation must follow to keep data safe. The 'building inspector' could be a security auditor or a compliance officer. They check that the company's networks, software, and employee habits match what the policy requires. Regulatory standards like GDPR or HIPAA are like national building codes that overrule local rules. A 'stop-work order' is equivalent to disabling a vulnerable server or blocking a risky software update until it is made secure. Without these policies and inspections, digital systems would be as chaotic and dangerous as a city with no building regulations at all.
At its simplest, a security policy is a written document that describes how an organisation protects its information assets. It is not a technical tool like a firewall or an antivirus program; it is a human rulebook. The policy defines what is allowed, what is forbidden, and what the consequences are for breaking the rules. For example, a company might have a policy that says 'all laptops must be encrypted' or 'no one may share their password with a colleague'. These are simple, clear rules that everyone can understand.
A policy is the top-level document. Beneath it, you will find standards and procedures. Standards are specific, mandatory requirements that support the policy. If the policy says 'all laptops must be encrypted', the standard will specify which encryption algorithm is acceptable (like AES-256). Procedures are the step-by-step instructions for carrying out a task that meets the policy. For example, the procedure for encrypting a new laptop might involve these steps: 'Step 1: Install the encryption software. Step 2: Restart the computer. Step 3: Enter a recovery key.'
Compliance is the process of ensuring that the organisation actually follows its own policies, standards, and procedures. It is one thing to write a policy that says 'passwords must be 12 characters long'. It is another thing entirely to go through the records and verify that every single user account actually has a password that is 12 characters long. Compliance checks can be done manually by an auditor, or automatically by software that scans the network looking for weak passwords. When a company is 'compliant' with a regulation like GDPR, it means they have a policy in place that meets the regulation's requirements, and they have evidence that they are following that policy.
Governance is the overarching framework that decides who has the authority to make these policies, who is responsible for enforcing them, and how decisions are made when there is a conflict. For instance, who decides whether the company should buy a new firewall if the old one is failing? That is a governance question. Governance defines the roles and responsibilities. In many large companies, there is a steering committee made up of executives from legal, HR, and IT who review and approve major security policies.
There are different types of security policies that are commonly used in the industry. They include:
Acceptable Use Policy (AUP): This policy describes what employees are allowed to do with company equipment and data. For example, it might forbid personal use of the work laptop, such as watching streaming services during office hours.
Data Classification Policy: This policy defines how different types of data should be handled. Public data (like a press release) has fewer restrictions than confidential data (like customer credit card numbers).
Password Policy: This policy sets requirements for creating and managing passwords. It typically covers minimum length, complexity (must include numbers and special characters), and how often passwords must be changed.
Incident Response Policy: This policy describes the exact steps to take when a security breach is detected. It specifies who to contact first, how to contain the damage, and how to preserve evidence for investigators.
The reason these concepts are so important for the 350-701 exam is that the exam tests your understanding of how these pieces fit together. You need to know that a firewall is only as good as the policy that tells you which traffic to block. You need to know that compliance with a regulation requires evidence, not just a document. And you need to understand that governance is the decision-making structure that makes everything else possible. Without governance, policies become suggestions that no one has to follow.
Assess Current State
Before writing any policy, you must understand what rules (if any) already exist, what data the company holds, and which regulations apply. This step establishes a baseline so you know what gaps need to be filled.
Draft the Policy
Write a clear, concise document that states the objective, scope, and specific rules. Use language like 'must' for mandatory actions and 'should' for recommendations. Define key terms like 'sensitive data' so there is no ambiguity.
Obtain Approval
A policy must be approved by someone with authority, typically senior management or a governance committee. This gives the policy legal and organisational weight. Without approval, it is just a suggestion.
Communicate and Train
All affected employees must be told about the new policy and understand what it means for their daily work. Training sessions, email announcements, and signed acknowledgement forms ensure that ignorance is not an excuse later.
Implement Technical Controls
Translate the policy into technical rules where possible. If the policy says 'all laptops must be encrypted', deploy encryption software and configure it to enforce encryption before users can access files.
Monitor and Audit
Regularly check that the policy is being followed. Use automated scanning tools, log reviews, and periodic manual audits. Document the findings as evidence of compliance for regulators.
Review and Update
Policies become outdated as technology and threats evolve. Schedule a periodic review (at least annually) to update the policy. If a new regulation passes or a major security incident occurs, trigger an immediate review.
Imagine you are the first security hire at a fast-growing online retailer with 500 employees. The company has grown from a startup of 10 people, where everyone just shared passwords and did what they thought was best. Now, the company has customers in Europe, so it must comply with GDPR. What do you actually do?
First, you assess the current state of security. You talk to department heads and ask what rules they already have. Most likely, you will find that there are no written policies at all. People are using personal email accounts to send customer data. Some employees use the same password for everything. This is a compliance disaster waiting to happen.
Your next step is to draft a set of core policies. You start with an Acceptable Use Policy, a Password Policy, and a Data Classification Policy. You collaborate with the legal team to ensure these policies meet GDPR requirements. For example, the Data Classification Policy must include a definition of 'personal data' that matches GDPR's definition. You circulate the drafts to department heads for feedback, then take the final versions to the chief executive for approval.
Once the policies are approved, you need to communicate them. You cannot just post them on the company intranet and hope people read them. You schedule mandatory training sessions for all employees. In the training, you explain the policies in plain language and give examples. For the Password Policy, you show people how to use a password manager so they do not need to remember 20 different complex passwords.
The hard part comes next: enforcement and verification. You need to check that people actually follow the rules. This is where compliance tools come in. You might deploy a tool that scans the network and reports any device that is not encrypted. You set up a system that forces users to change their password every 90 days. You also conduct random audits. You pick a team at random and ask for a review of their file-sharing permissions to ensure customer data is not accessible to everyone in the company.
Finally, you set up a governance committee. You bring together the heads of IT, legal, HR, and finance. This committee meets quarterly to review the policies, discuss any security incidents that happened, and decide on changes. If a new regulation comes out, the committee decides whether the policy needs to be updated. This committee is the 'governance' in action. It ensures that security decisions are made by the right people, not just by whoever shouts loudest in the hallway.
The 350-701 exam tests your knowledge of security policies, compliance, and governance in several specific ways. First, expect multiple-choice questions that ask you to match a policy type to its description. For example, you might be asked: 'Which policy defines the rules for using company resources for personal activities?' The answer is the Acceptable Use Policy (AUP). They love to test the difference between a policy, a standard, a procedure, and a guideline (which is a non-mandatory recommendation). Memorise these definitions precisely.
Second, they test your understanding of compliance frameworks and regulations. The exam expects you to know the basic requirements of some common regulations, including:
GDPR (General Data Protection Regulation): Covers personal data of EU citizens. Requires breach notification within 72 hours.
HIPAA (Health Insurance Portability and Accountability Act): Protects medical information in the US.
PCI DSS (Payment Card Industry Data Security Standard): Governs how credit card data is handled.
Do not expect deeply detailed questions about the legal text, but do expect questions like: 'A company that handles credit card numbers must comply with which standard?' The answer is PCI DSS.
Third, they test governance concepts. You need to understand the difference between a policy creator (senior management or a board) and a policy implementer (the IT team). The exam will test the concept of 'separation of duties' — the idea that no single person should have all the power to commit fraud. For example, the person who approves a purchase order should not be the same person who pays the invoice.
Common traps include:
Confusing a 'guideline' with a 'policy'. A guideline is advisory; a policy is mandatory. If the exam says 'must' or 'shall', it is a policy. If it says 'should' or 'may', it is a guideline.
Mixing up 'due care' and 'due diligence'. Due care means taking reasonable steps to protect data (like implementing a firewall). Due diligence means investigating a third party before working with them (like checking their security track record).
Assuming compliance equals security. Being compliant with a regulation does not mean you are secure. Regulations are the minimum bar, not a guarantee of safety.
They also like to test the 'policy lifecycle'. The steps are: creation, approval, communication, implementation, enforcement, monitoring, and review. You should memorise this order. A question might present a scenario where a policy was created but never communicated, and then ask what went wrong.
A security policy is a written rulebook, not a technical tool, and it sits above standards, procedures, and guidelines in the hierarchy.
Compliance means proving that you follow your own policies and meet regulatory requirements, often through audits and evidence collection.
Governance defines who has the authority to make and approve security decisions, ensuring accountability at the executive level.
Regulations like GDPR, HIPAA, and PCI DSS are external legal requirements that your internal policies must satisfy.
An Acceptable Use Policy (AUP) governs how employees may use company assets and is one of the first policies a growing organisation should implement.
A policy lifecycle includes creation, approval, communication, implementation, enforcement, monitoring, and regular review.
Due care is taking reasonable precautions; due diligence is investigating partners and vendors before sharing data with them.
No amount of policy writing protects you if you do not also train employees and audit compliance regularly.
These come up on the exam all the time. Here's how to tell them apart.
Policy
High-level statement of intent (e.g. 'encrypt all data').
Mandatory, but not technically specific.
Created by senior management or a governance body.
Standard
Specific, mandatory requirement (e.g. 'use AES-256').
Technical in nature, provides measurable criteria.
Created by technical experts or security architects.
Due Care
Taking reasonable steps to protect your own organisation.
Focuses on internal security practices and controls.
If you fail, you can be sued for negligence.
Due Diligence
Investigating a third party before partnering with them.
Focuses on external relationships, like vendors or cloud providers.
If you fail, you are liable for the partner's security failures.
Compliance
Meeting external regulatory requirements.
Is a snapshot at a point in time (an audit date).
Can be achieved with a checklist approach.
Security
Protecting data from all threats, known and unknown.
Is a continuous, evolving process.
Requires ongoing monitoring, patching, and adaptation.
Guideline
Advisory in nature (uses 'should' or 'may').
Offers recommendations but no enforcement.
Example: 'You should use a password manager.'
Procedure
Mandatory step-by-step instructions (uses 'must').
Describes exact actions to achieve a policy requirement.
Example: 'Step 1: Open the encryption tool. Step 2: Click Encrypt.'
Mistake
A security policy is the same thing as a firewall rule.
Correct
A security policy is a high-level human document that states what must be protected, while a firewall rule is a low-level technical configuration that implements one part of that policy. They are not interchangeable.
Beginners often confuse the abstract 'policy' with the concrete 'tool'. They hear 'security policy' and think of an ACL (Access Control List) on a router. The exam tests the distinction between the rulebook and the tool.
Mistake
Compliance means you are 100% secure.
Correct
Compliance only means you meet the minimum requirements of a regulation. A company can be PCI DSS compliant and still get hacked on the very same day if they missed a threat that the standard does not cover.
Marketing from security vendors often implies that compliance equals safety. People want a guarantee, but security is a continuous process, not a checkbox.
Mistake
Once you write a policy, your job is done.
Correct
A policy is useless if it is not enforced, reviewed, and updated regularly. The real work is in training, auditing, and adapting the policy to new threats and business changes.
Writing a document is easy. The labour of changing human behaviour and keeping systems aligned is hard. Beginners underestimate the operational effort.
Mistake
Policies are only for big corporations with legal teams.
Correct
Even a small business with two employees should have a basic password policy and a data classification policy. Many small businesses are required to comply with regulations like GDPR if they serve European customers.
Small business owners often think they are 'too small to be a target' or that compliance is too expensive. The reality is that attackers target small businesses precisely because they lack policies.
Mistake
Governance is just another word for management.
Correct
Governance specifically refers to the framework of authority and accountability for decision-making, whereas management is about executing those decisions on a day-to-day basis. The board of directors governs; the IT manager manages.
The terms sound similar in plain English, but the exam draws a sharp line between the two. Confusing them leads to wrong answers in scenario-based questions.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A policy is a high-level statement of intent and rules, like 'all data must be encrypted'. A standard is a specific mandatory requirement that supports the policy, such as 'encryption must use AES-256'.
No. The exam tests your understanding of what each regulation covers (e.g. GDPR protects EU personal data, HIPAA protects medical info) but not specific article numbers. Focus on the general scope and key requirements.
A governance committee is a group of senior stakeholders responsible for approving and overseeing security policies. It typically includes representatives from IT, legal, HR, finance, and executive management.
You can prove compliance manually using spreadsheets and signed documents. For example, keep a log of password changes or print and sign a checklist during audits. However, automated tools make the process much easier and less error-prone.
Consequences vary by company but can include a verbal warning, written reprimand, loss of access privileges, or termination. The policy document should list the potential disciplinary actions so employees know the stakes.
No. Compliance means you meet external legal requirements, which is the minimum bar. Security is a broader goal of protecting data from all threats. You can be compliant and still be insecure.
You've finished Security Policies and Compliance. Continue through the 350-701 study guide to build a complete picture of the exam.
Done with this chapter?