Cissp: Policies, Standards, Baselines, Guidelines, And Procedures

Front 1

Regulatory

Back 1

This type of policy ensures that the organization is
following standards set by specific industry regulations (HIPAA, GLBA,
SOX, PCI-DSS, etc.). It is very detailed and specific to a type of industry.
It is used in financial institutions, healthcare facilities, public utilities,
and other government-regulated industries.

Front 2

Advisory

Back 2

This type of policy strongly advises employees as to which
types of behaviors and activities should and should not take place
within the organization. It also outlines possible ramifications if
employees do not comply with the established behaviors and activities.
This policy type can be used, for example, to describe how to handle
medical or financial information.

Front 3

Informative

Back 3

This type of policy informs employees of certain topics.
It is not an enforceable policy, but rather one that teaches individuals
about specific issues relevant to the company. It could explain how the
company interacts with partners, the company’s goals and mission, and
a general reporting structure in different situations.

Front 4

security policy

Back 4

High-level document that outlines senior management’s
security directives

Front 5

Standards

Back 5

mandatory activities, actions, or rules that give a policy
its support and reinforcement in direction

Front 6

baseline

Back 6

point in time that is used as a comparison for future
changes. used to define the minimum level of protection required.

Front 7

Guidelines

Back 7

recommended actions and operational guides to users, IT staff, operations
staff, and others when a specific standard does not apply. Suggestions and best practices.

Front 8

Procedures

Back 8

detailed step-by-step tasks that should be performed to achieve a certain
goal

Front 9

Organizational (master), issue-specific, system-specific.

Back 9

Policy types