CISSP Security and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Policies are created by IT, while guidelines are created by executives

  Why it's wrong here

  This statement is incorrect because the creation of policies and guidelines is not strictly segregated by department. While IT personnel often contribute significantly to the development of security policies, especially technical ones, policies typically require formal approval from senior management or executives to ensure organizational authority, widespread enforcement, and alignment with business objectives. Guidelines can also originate from various departments, including executive leadership, to provide recommended best practices without the mandatory compliance aspect of a policy.

• ✗

  Policies are technical, while guidelines are managerial

  Why it's wrong here

  This option is inaccurate as the scope of both policies and guidelines can span technical and managerial domains. Policies can be high-level, strategic directives (managerial), such as an "Acceptable Use Policy," or very specific, technical requirements, like a "Password Complexity Policy" detailing specific algorithms or lengths. Similarly, guidelines can offer managerial advice on risk assessment or detailed technical instructions for secure system configuration. The nature of their content does not serve as a distinguishing factor between them.

• ✓

  Policies are mandatory, while guidelines are recommended

  Why this is correct

  This is the correct distinction. Policies are formal, high-level statements that mandate specific actions or behaviors, establishing compulsory rules that all relevant parties must adhere to, with non-compliance typically incurring disciplinary or legal consequences. In contrast, guidelines provide recommended best practices, suggestions, or advisory information designed to assist individuals in making informed decisions or performing tasks, but they are not strictly enforced. This fundamental difference in obligation and enforceability is key to their purpose within an organization's governance framework.

• ✗

  Policies are static, while guidelines are updated frequently

  Why it's wrong here

  This statement is incorrect because neither policies nor guidelines are inherently static or frequently updated relative to each other. Both types of documents are dynamic and must be regularly reviewed and revised to reflect changes in the threat landscape, technology, regulatory requirements, or organizational structure. While policies might aim for a degree of stability due to their mandatory nature and the effort involved in formal approval, they are certainly not immune to necessary updates, and guidelines are not exclusively characterized by more frequent revisions; both respond to evolving needs.

Go deeper

Related to this question