If you leave a company without clear security rules, each employee will handle sensitive data in their own random way—some might email credit card numbers, others might leave passwords on sticky notes. That chaos is exactly why organisations write security policies, standards, and procedures: they replace guesswork with a single, repeatable system that keeps everyone on the same page. For the 200-201 exam, you must understand exactly how these three documents differ, and why they work together to create a defensible security posture.
Jump to a section
A simple way to picture Policies and Standards for Cybersecurity
A Health Inspector walks into a busy restaurant kitchen. They don't check whether the chef is a good cook—that's the chef's own skill. Instead, they check for the kitchen's _policies_ ('Wash hands every 30 minutes'), its _standards_ ('Fridge must be below 4°C'), and its _procedures_ ('How to correctly label and date every container'). The inspector doesn't enforce these rules every second—that's the restaurant manager's job. But if the restaurant fails an inspection, it can be shut down.
In cybersecurity, a security policy (like the restaurant's 'wash hands' rule) is a high-level document from leadership stating what the organisation wants—for example, 'All customer data must be encrypted.' A standard (like the 'fridge at 4°C') is a specific technical requirement: 'Use AES-256 encryption.' A procedure (like labelling containers step-by-step) is the exact, repeatable checklist: 'Step 1: Open the encryption tool. Step 2: Enter the key. Step 3: Verify the hash.' Just as the restaurant uses all three layers to prevent food poisoning, a security team uses policies, standards, and procedures to prevent data breaches. Without them, every employee does things differently—some safe, some reckless—and the organisation has no consistent way to stay secure.
Welcome to the world of security governance. Think of it as the rulebook for how an organisation protects its information. The 200-201 exam expects you to know three specific types of documents: policies, standards, and procedures. They form a hierarchy—each one is more detailed than the last. Let's break them down from the top.
A policy is a high-level document created by senior leadership (like the Chief Information Security Officer or the board of directors). It states _what_ the organisation wants to achieve. For example, a policy might say: 'All company data must be classified as public, internal, or confidential.' It doesn't tell you _how_ to classify data—it just sets the rule. Policies are mandatory. If you violate a policy, you can be disciplined or fired. They are the 'why' and the 'what.'
A standard sits one level below a policy. Standards are specific technical rules that support the policy. While the policy says 'classify data,' the standard says exactly what counts as confidential data: 'Any data containing personally identifiable information (PII) like Social Security numbers or health records is automatically classified as confidential.' Standards are also mandatory, but they are more technical. They might specify which encryption algorithm to use (AES-256), which password length to require (12 characters), or which firewall rules to apply. Without standards, everyone would interpret the policy differently.
A procedure (sometimes called a guideline or a work instruction) is the step-by-step 'how-to' for meeting the standard. It is the most detailed document. For example, if the standard says 'use AES-256 encryption,' the procedure will walk you through exactly how to enable that encryption in your specific software, step by step. Procedures are often optional—you can adapt them to your local situation—but following them consistently ensures everyone does the job the same way.
These three layers connect to other important exam concepts. A baseline is a minimum set of standards that every system must meet. For example, a security baseline might say 'All servers must have antivirus installed and automatic updates enabled.' A framework is a collection of policies, standards, and procedures from a respected outside body—like the NIST Cybersecurity Framework (from the US National Institute of Standards and Technology) or ISO 27001 (an international standard). Organisations adopt these frameworks as a starting point, then customise them.
Why does this hierarchy matter? Because it turns abstract goals into real, repeatable actions. Without a policy, nobody knows what leadership wants. Without a standard, nobody knows the exact technical requirement. Without a procedure, each technician guesses how to implement it, leading to mistakes. The exam will test whether you know which document is which and what each layer does.
One more piece: compliance. This means following the rules. If an organisation's policy says 'encrypt all laptops,' and every laptop is encrypted, the organisation is compliant. If a laptop is not encrypted, that is a violation (or a non-compliance). Auditors (internal or external) check for compliance. The 200-201 exam will ask you to identify the correct document type for a given scenario—for instance, 'The CEO signs a document stating that all data must be encrypted. What type of document is this?' The answer: a policy.
Finally, understand that policies, standards, and procedures must be living documents. They need regular review (often annually) because technology and threats change. If a standard says 'use TLS 1.2' and a new vulnerability is found, the organisation must update that standard. The exam might ask about the review cycle or version control of these documents.
Identify the Need
Leadership recognises a new risk or a new regulation (like GDPR or PCI DSS). They decide a policy is needed to address the risk. For example, 'We need a policy on data retention.' This step establishes the 'why' and the high-level goal.
Draft the Policy
The CISO or a policy committee writes the policy document. It states the broad rule—e.g., 'Customer data must be deleted after 3 years.' The policy is reviewed by legal and signed by the CEO. This makes it official and binding.
Create Supporting Standards
The security team writes standards that define the exact technical requirements for the policy. For the data retention policy, the standard might say: 'After 3 years, run SQL script X to delete records, and verify using tool Y.' Standards are more detailed than policies but less detailed than procedures.
Develop Procedures
System administrators write step-by-step procedures that show exactly how to implement the standard. This includes commands, screenshots, and error-handling steps. Procedures ensure consistency—every technician does it the same way.
Implement and Enforce
IT staff follow the procedures to configure systems according to the standards, in line with the policy. Managers enforce compliance through audits and reviews. Non-compliance is reported and corrected.
Review and Revise
Annually (or after a major incident), the security team reviews all three layers. If a standard becomes outdated (e.g., a new encryption algorithm is required), they update the standard and the accompanying procedure. The policy might also need revision if the business changes.
Let me walk you through a concrete example from my own experience. I worked for a medium-sized company that processed credit card payments. We were required to follow the PCI DSS standard (Payment Card Industry Data Security Standard). The company had to create its own policies, standards, and procedures to prove compliance. Here is how it actually worked, day to day.
First, the CISO (Chief Information Security Officer) drafted a Acceptable Use Policy (AUP). This was a policy document that said, 'Employees must not use company devices for personal shopping that involves credit card data.' That is a policy—high-level, mandatory, signed by the CEO. It told everyone _what_ the rule was.
Next, the security team wrote a Data Encryption Standard. This document said exactly which encryption algorithm to use (AES-256) and exactly where to apply it (on all databases storing primary account numbers). This was a standard—more specific than the policy, but still not a step-by-step guide.
Then came the Encryption Procedure. This was a 10-page document that gave step-by-step instructions for a system administrator: 'Log into the database server, open the encryption tool, select the column containing card numbers, choose AES-256 from the dropdown, click Encrypt, and then run the verification script.' That was the procedure.
In the real world, we faced common problems: - Outdated documents: A procedure said to use an old software version that had been replaced. We had to update it. - Lack of awareness: New hires didn't know the policy existed. We had to make them sign an acknowledgement during onboarding. - Inconsistency: Different teams wrote their own standards that contradicted each other. We had to centralise document control.
As an IT professional, your daily tasks might include:
Reviewing a proposed policy change from management
Writing or updating a standard for a new technology (like a new cloud service)
Creating a procedure for a specific task (like 'how to reset a user's password securely')
Auditing systems to check compliance with a current standard
Reporting a policy violation to the security team
The exam will test whether you can apply these concepts to realistic scenarios. For example, they might describe a situation where a technician cannot find the standard for password length. You should know that the technician should look for a standard document (not a policy or procedure) that states 'minimum 8 characters.'
The 200-201 exam tests this objective in several specific ways. You must be able to distinguish between a policy, a standard, and a procedure with 100% accuracy—they love to swap these terms in the answer choices. Here is exactly what to expect.
Question types: - Scenario-based multiple choice: They describe a situation (e.g., 'The security team issues a document stating that all passwords must be 12 characters. What type of document is this?') and you pick the correct type. The trap is often calling it a 'procedure' when it is actually a 'standard.' Remember: a standard states a _requirement_ (what the number is), while a procedure states _how to implement_ it. - Match the document type: They give you three descriptions and three labels. You must match each description to policy, standard, or procedure. - Best practice questions: They ask 'What should an organisation do first when creating a security program?' The correct answer usually involves creating a policy, then standards, then procedures—in that order.
Traps to watch for: - 'Policy' vs. 'Procedure' confusion: If a document says 'Log in and change the setting' it is a procedure, not a policy. Policies do not include step-by-step commands. - 'Standard' vs. 'Baseline' confusion: A baseline is a type of standard (the minimum acceptable level), but on the exam, they usually treat 'baseline' as a separate concept. Know that a baseline sets a minimum, while a standard can be more ambitious. - 'Guideline' vs. 'Procedure': Some questions use the word 'guideline.' A guideline is a _non-mandatory_ recommendation, while a procedure is often mandatory. On the exam, if they say 'guideline,' treat it as optional.
Key definitions to memorise: - Policy: 'What must be done' (high-level, signed by leadership) - Standard: 'How it must be done technically' (specific requirements) - Procedure: 'Step-by-step instructions to implement the standard' - Baseline: 'Minimum security configuration' - Framework: 'A collection of policies, standards, and procedures from a trusted source'
Exam objectives directly tested: - 6.2.a: Identify the differences between policies, standards, and procedures - 6.2.b: Given a scenario, determine the appropriate document type - 6.2.c: Explain the role of compliance and audits
The exam expects you to know that policies are the 'top' of the hierarchy and must not contain technical steps. If you see a document that mentions 'in accordance with ISO 27001,' that is a framework reference. They might also ask: 'Why are regular reviews of security documents necessary?' The correct answer involves 'because technology and threats change.'
A policy is a high-level document from leadership stating 'what' must be done, and it is mandatory.
A standard is a specific technical requirement that supports a policy—it says 'exactly how' in technical terms.
A procedure is a step-by-step guide for implementing a standard—it is the most detailed document.
Policies, standards, and procedures form a hierarchy; policies are broadest, procedures are most specific.
A baseline is a minimum standard that all systems must meet—it is the floor, not the ceiling.
Security documents must be reviewed and updated regularly because technology and threats evolve.
These come up on the exam all the time. Here's how to tell them apart.
Policy
High-level document from leadership
States 'what' must be done (e.g., encrypt data)
No technical step-by-step instructions
Procedure
Detailed, low-level document
States 'how' to implement a task step-by-step
Contains commands, screenshots, and checklists
Standard
A specific technical requirement from a policy
Can be set at any level (e.g., 12-char password)
May be higher than the bare minimum
Baseline
The minimum acceptable configuration
The lowest bar that must be met (e.g., 8-char password)
Is a type of standard, but focused on 'minimum'
Policy
Organisation-specific document
Created internally by leadership
Mandatory within that organisation
Framework
A collection of best practices from an external body (e.g., NIST)
Used as a reference or starting point
Optional until adopted as policy by an organisation
Procedure
Step-by-step instructions, often mandatory
Designed to be followed exactly
Usually written for a specific task or tool
Guideline
Non-mandatory recommendations
Provides general advice on best practice
May cover broader scenarios without exact steps
Mistake
Policies and procedures are the same thing — they both just tell you what to do.
Correct
Policies state the high-level 'what' and 'why' (e.g., 'All data must be encrypted'), while procedures give step-by-step 'how' instructions (e.g., 'Click Encrypt in software X'). They are different documents with different levels of detail.
People use the words interchangeably in everyday speech, so they assume the technical definitions are also interchangeable. The exam specifically tests the distinction.
Mistake
Standards are optional suggestions, not mandatory rules.
Correct
Standards are mandatory technical requirements that support a policy. For example, if the policy says 'encrypt data,' the standard might say 'use AES-256' — and you must follow that specific algorithm.
The word 'standard' sounds like 'common practice' or 'guideline' to beginners, but in cybersecurity it means a binding rule.
Mistake
A security policy can be written by anyone in the IT department, like a network engineer.
Correct
Policies must be created and signed by senior leadership (CISO, CEO, board of directors). A network engineer writes procedures, not policies.
In small companies, the same person might wear multiple hats, blurring the lines. The exam assumes a formal organisational structure.
Mistake
Once a policy is written, it never needs to be changed.
Correct
Policies, standards, and procedures must be reviewed regularly (often annually) and updated when technology, threats, or regulations change.
People think of rules as static like a constitution. But cybersecurity evolves fast, so documents must evolve too.
Mistake
A baseline is the same as a standard — they are just two words for the same thing.
Correct
A baseline is a specific type of standard that sets the _minimum_ acceptable configuration. Other standards can be higher than the baseline (e.g., 'recommended' vs. 'minimum').
Many beginners see 'minimum' and 'standard' and assume they are identical. The exam distinguishes them as related but different.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A policy is a high-level rule from leadership (e.g., 'All data must be encrypted'), while a standard is a specific technical requirement that supports the policy (e.g., 'Use AES-256 encryption'). Policies say 'what,' standards say 'exactly how' in technical terms.
Procedures are often mandatory within a specific team or for a specific task, but they can also be guidelines. On the 200-201 exam, treat procedures as the detailed 'how-to' that must be followed to achieve the standard.
No. A procedure is too detailed and too low-level to replace a policy. Policies provide the overarching direction, while procedures provide the step-by-step steps. Both must exist at different levels of the hierarchy.
Typically, the Chief Information Security Officer (CISO) or a policy committee drafts it. It must be approved and signed by senior leadership (CEO or board of directors) to be binding.
It is a collection of policies, standards, and guidelines published by the US National Institute of Standards and Technology. Organisations use it as a starting point to build their own security program.
At least annually, or after a significant security incident, or when technology changes. The exam expects you to know they are living documents that need regular updates.
You've finished Policies and Standards for Cybersecurity. Continue through the 200-201 study guide to build a complete picture of the exam.
Done with this chapter?