Skip to content
All articles
November 5, 2026 12 min read

Policy, Standard, Procedure, Guideline: The Governance Hierarchy, the Seven Named Policies, and Who Owns the Data on Security+

Chris Rees

Chris Rees

25+ years in IT · Pluralsight author, 4.6/5 across 2,000+ ratings

Policy, Standard, Procedure, Guideline: The Governance Hierarchy, the Seven Named Policies, and Who Owns the Data on Security+
Skillthropicwww.skillthropic.com

Governance questions on Security+ look easy and are missed constantly. The stem describes a document in one sentence, "all sensitive data must be encrypted at rest," "use AES-256," "step one, open the key console," "where practical, prefer hardware-backed keys," and offers policy, standard, procedure and guideline as the answers. The sentence never uses the term. Objective 5.1 is the hierarchy those four words form, the documents the outline names, the outside forces that shape them, the structures that oversee them, and the four roles that decide who is accountable for data. Two questions classify any document; the rest is one-line identifiers.

Four buckets, two questions

Governance answers a deceptively simple question: who decides what "secure" means, and how do we know everyone follows the decision? Without it, security is individual heroics that no auditor can verify. The fix is documents with different levels of authority and detail, and the exam expects you to place any document into one of four buckets.

The governance document hierarchy drawn as a four-tier pyramid, policy at the apex, then standard, then procedure, then guideline at the base, each tier labeled mandatory or advisory, with an example chain beside it showing a policy that sensitive data must be encrypted at rest, the standard that names AES-256 and TLS 1.2 or higher, the procedure that begins with opening the key management console, and the guideline that recommends hardware-backed key storage where practical ONE INTENT, FOUR DOCUMENTS Policy mandatory: what and why Standard mandatory: how much, which one Procedure mandatory: step-by-step how Guideline advisory: recommended, not required the policy says "All sensitive data must be encrypted at rest." the standard says "AES-256 at rest, TLS 1.2 or higher in transit." the procedure says "Step 1: open the key management console and..." the guideline says "Where practical, prefer hardware-backed key storage." Two questions classify any document: is it mandatory, and how specific is it? Only the dashed tier is optional.
Specificity increases as you move down; authority does not. Policies, standards and procedures are all mandatory. Only the guideline may be declined.

A policy is mandatory and high level: management's intent, the what and the why, approved by senior leadership. A standard is mandatory and specific: the measurable requirement that makes the policy enforceable, a number, an algorithm, a configuration. A procedure is mandatory and sequenced: the exact steps, so the outcome is the same whoever performs them. A guideline is advisory: recommended practice for situations the mandatory documents do not cover.

Exam tip: Mandatory plus broad is policy. Mandatory plus a specific requirement is standard. Mandatory plus sequenced steps is procedure. Optional is guideline. If the stem says "recommended" or "suggested," the answer is guideline no matter how technical the sentence sounds; candidates see an algorithm name and pick standard.

The seven policies the outline names

Objective 5.1 lists seven policy areas, and each comes with a one-line scenario the exam uses to identify it.

Policy What it governs The identifying sentence
Acceptable use (AUP) what users may do with systems, email and internet; signed at onboarding "Employees may not use company email for personal business."
Information security the umbrella statement of how CIA is protected "All PII must be classified and protected according to its sensitivity."
Business continuity keeping critical business functions running during a disruption "If the ordering system fails, staff switch to the manual process."
Disaster recovery restoring IT systems and data afterward; the technology subset of BC "Restore the database from offsite backups at the warm site within 8 hours."
Incident response roles and process for detecting, containing and recovering from incidents "On confirmed ransomware, the IR lead invokes containment."
Software development lifecycle security requirements at every phase of building software "All code must pass static analysis before merging to production."
Change management how changes are proposed, approved, tested and rolled back "All firewall rule changes require CAB approval and a backout plan."

The classic trap is the pair in the middle. Business continuity keeps the business operating during the event: people, processes, alternate workflows. Disaster recovery gets technology back afterward: systems, data, sites. "Keep taking orders while the data center is down" is BC; "rebuild the data center" is DR. Incident response has its own lifecycle post; here the exam only needs the policy that assigns the roles.

Standards and procedures: the numbers and the steps

Standards translate intent into auditable requirements, and the objective names four. The password standard holds length, complexity, history, lockout and MFA requirements; NIST SP 800-63B favors length and breached-password screening over forced periodic changes, but the standard is wherever the organization writes its numbers down. The access control standard covers how access is requested, approved, reviewed and revoked, and how privileged accounts are handled. The physical security standard sets badge requirements, visitor escort, camera coverage and data center access. The encryption standard lists approved algorithms and key lengths, key management, and which classifications require encryption.

Procedures are the operational layer, and the outline names three families. The change management procedure runs request, impact analysis, change board approval, test, scheduled window, implement, verify, document, with a backout plan. Onboarding creates the identity, grants least-privilege access, collects the signed AUP and assigns training; offboarding disables accounts immediately, revokes credentials, recovers devices and badges, and transfers data ownership. Playbooks are pre-written steps for one scenario, a phishing playbook that isolates the mailbox, pulls the message organization-wide, resets credentials and reviews sign-in logs, so handling is consistent under pressure.

Offboarding is the procedure the exam tests most, because its failure has a signature: a former employee logging in means the offboarding procedure was missing, with periodic account review as the detective follow-up.

The forces outside the building

Obligations arrive from outside at several levels, and the policy suite must satisfy all of them.

Consideration What it is Example
Regulatory rules issued and enforced by government agencies, with fines HIPAA for US healthcare; GDPR enforcement by EU authorities
Legal statutes, contract law, liability, breach notification duties counsel reviews policies for exposure
Industry sector obligations, often contractual rather than governmental PCI DSS for anyone handling payment cards
Local / regional state or provincial law CCPA; state breach notification statutes
National country-level law HIPAA, SOX, GLBA in the US
Global frameworks that reach across borders GDPR applies to anyone processing EU residents' data

The discriminator the exam likes is industry versus regulatory. PCI DSS is an industry standard, enforced through contracts with card brands and acquiring banks, not a government regulation, so a question about a merchant's card requirements wants industry. GDPR and HIPAA are regulatory. The other axis is jurisdiction: a multinational satisfies local, national and global layers simultaneously, which is why the same data can carry three notification rules.

Who governs, and how centrally

Boards of directors hold ultimate accountability for organizational risk, set risk appetite and direct executive leadership. Committees are chartered subgroups for a focus area that translate board direction into oversight of specific programs and report back upward. Government entities create and enforce rules or provide guidance: regulators, legislatures, and agencies such as NIST for frameworks and CISA for critical infrastructure.

The remaining pair is a design choice. Centralized governance puts one authority, typically a CISO office, in charge of security decisions for the whole organization: consistent, easier to evidence, slower and less tailored. Decentralized governance lets business units or regions decide within corporate guardrails: agile and locally fit, at the cost of inconsistency, duplicated effort and harder auditing. The exam's answer to "which is better" is always the trade-off.

Owner, controller, processor, custodian

Four roles recur through Domain 5 and again in the privacy objective, and the exam swaps them freely because their names sound interchangeable. Two are accountability roles, one is hands-on, and two are the GDPR's privacy-law pair.

A responsibility grid for the four data roles, owner, controller, processor and custodian or steward, across four columns, what the role decides, what it is accountable for, a typical person in the role, and the wording in an exam stem that signals it, showing that the owner and controller decide and are accountable while the processor and custodian act on someone else's decision WHO DECIDES, WHO IS ACCOUNTABLE, WHO DOES THE WORK Decides Accountable for Typical person Stem signal Owner the classification andwho may access the asset the asset itself andevery risk decision about it VP of Sales, for thecustomer database accepts the risk,approves access Controller why and how personaldata is processed data subjects' rights,under privacy law the retailer collectingcustomer emails determines the purposeof processing Processor nothing new; acts onlyon the controller's orders processing exactly asthe contract instructs the email-marketingplatform the retailer hires on behalf of,per instructions Custodian or steward how protection isimplemented day to day backups, encryption,provisioning, data quality the DBA or storage adminmaintaining the database implements, maintains,operates Owner and controller decide and are accountable. Processor and custodian act on someone else's decision.
Accountability stays in the top two rows even when all the work happens in the bottom two. Delegating the task never delegates the answerability.

The owner is ultimately accountable for an asset or dataset: sets its classification, approves access, accepts risk decisions, and is usually a senior business person rather than IT. The controller determines the purposes and means of processing personal data and bears primary legal responsibility for data subjects' rights. The processor handles personal data on the controller's instructions and cannot decide new purposes for it. The custodian or steward does the daily technical care the owner requires.

The controller-versus-processor question has one test: who decides why the data is processed? That party is the controller; anyone processing under its instructions is a processor. The distractor calls the IT department the controller because it controls systems, but controller is about deciding purposes, not administering infrastructure. The owner-versus-custodian question is the museum: the curator decides which paintings matter and who may view them; the guard protects them each night. The controller and processor pair decides who owes what when a provider is breached, so it returns in the cloud forensics notification clock.

Monitoring and revision

Governance documents decay. Threats evolve, laws change, mergers redraw the org chart, and an old policy may now be wrong or unenforceable. Effective governance therefore includes monitoring, measuring whether policies are followed through compliance dashboards, audit findings, exception counts and SIEM data, and revision on a defined cycle, commonly annual, plus event-driven triggers: a new regulation, a major incident, an acquisition, a technology shift. Every document carries an owner, a version, an approval date and a next-review date; a policy nobody has read since it was written is a monitoring-and-revision failure.

Four stems, decoded

  1. A document states that all remote access must use MFA and lists the two approved authenticator types. Standard. Mandatory and specific; the approved types are the measurable requirement.
  2. A document recommends that developers use a particular linting configuration where their project allows. Guideline. "Recommends" and "where allowed" make it advisory, however technical the content.
  3. A merchant asks which external consideration drives its card-handling security requirements. Industry. PCI DSS is contractual, enforced by card brands and acquirers, not a regulation.
  4. A cloud email platform sends marketing on a retailer's instructions and asks whether it is the controller. No. The retailer decides the purpose, so it is the controller; the platform is the processor.

Key takeaways

  • Two questions classify any document: is it mandatory, and how specific is it? Policy is mandatory and broad, standard is mandatory and measurable, procedure is mandatory and sequenced, guideline is advisory.
  • Seven named policies, each with an identifying sentence. BC keeps the business running during the event; DR restores the technology afterward.
  • Standards hold the numbers; procedures hold the steps. A former employee logging in means the offboarding procedure failed.
  • PCI DSS is industry, GDPR and HIPAA are regulatory, and jurisdiction stacks from local to global. Boards direct, committees oversee, government entities regulate; centralized is consistent, decentralized is flexible.
  • Owner is accountable, controller decides purposes, processor acts on instructions, custodian does the daily care. Delegating the work never delegates the accountability.

Security governance is objective 5.1 of Security+ Domain 5, Security Program Management and Oversight, 20% of the exam. The document hierarchy is the frame every later objective hangs on: the risk register in 5.2 and the vendor agreements in 5.3 are governance artifacts too. Work all 35 Domain 5 topics with our free Security+ Domain 5 study guide.

#SecurityPlus #SY0701 #SecurityGovernance #SecurityPolicy #DataOwner #GDPR #PCIDSS #ExamPrep #InfoSec #CyberSecurity

Security+ Domain 5 · program management & oversight

Make the governance domain count

Risk management, third-party risk, compliance, and audits, Security+ Domain 5 is 20% of the exam. Study all 35 topics with our objective-mapped guide.

Get the Domain 5 guide

Share this article

Keep reading

Security+ deep dives

MSA, SOW, SLA, BPA, NDA: The Third-Party Risk Alphabet, and Which Document Answers Which Question

Your vendors are your attack surface, and Security+ Domain 5 tests whether you know the paperwork that manages them. Objective 5.3 end to end: the vendor lifecycle from due diligence to offboarding, the agreement stack (master agreement, statements of work, service levels, business partners, non-disclosure, memoranda), right-to-audit and rules of engagement, questionnaires and ongoing monitoring, and supply chain analysis.

Read Security+ deep dives

Establish, Deploy, Maintain: Secure Baselines, Hardening Targets, BYOD vs. COPE vs. CYOD, and WPA3 on Security+

Objective 4.1 is the widest bullet in the biggest domain, and it hides its questions in verbs and ownership: which baseline step failed when settings drifted, which mobile model gives the least control, why WPA3 ends the offline handshake attack, which application control stops which flaw. The baseline lifecycle, hardening emphasis by device class, site surveys and heat maps, MDM and deployment models, 802.1X with RADIUS, and the application security checklist, decoded the way the exam asks them.

Read Security+ deep dives

SPF, DKIM, DMARC, and Friends: The Enterprise Security Capabilities Security+ Expects You to Configure

Objective 4.5 is where Security+ stops asking what a control is and starts asking where it goes. Email authentication drawn as one flow (SPF checks the sender, DKIM signs the message, DMARC decides what happens), web and DNS filtering, DLP and what it can actually see, EDR versus XDR, NAC posture checks, file integrity monitoring, and the placement map that answers every scenario in the objective.

Read

Follow Skillthropic

Keep learning between study sessions

The same exam-focused teaching, in smaller pieces, wherever you scroll.

YouTube@skillthropic10,000+ subscribers. Exam lessons, AI security news and Shorts.Subscribe →Instagram@skillthropicSwipeable exam-concept carousels and lesson Reels.Follow →TikTok@skillthropicQuick security explainers you can watch between study sessions.Follow →Bluesky@skillthropic.comA free practice question every day, plus each new article.Follow →

Enjoyed this? Get the AI security news that matters.

Join The AI Security Brief for the top AI security news, plus what's important to the C-suite. Free, straight to your inbox.

No spam. Unsubscribe anytime.