Which of the following defines the minimum acceptable rules for policy compliance?

Standards are mandatory rules, actions, or controls established to support and enforce a high-level policy. They specify the "what" that is required for compliance. For example, if a policy states that "all sensitive data must be encrypted," a corresponding standard would define the minimum acceptable rule, such as "AES-256 must be used for all data-at-rest encryption." Standards translate the broad intent of a policy into specific, compulsory requirements, thereby setting the minimum level of compliance for technologies, processes, and personnel behavior across the organization.

A. Baselines are a specific type of standard that defines a minimum security configuration for a system, whereas standards is the broader term for all mandatory rules.
B. Guidelines are recommended best practices and are not mandatory; therefore, they do not define minimum acceptable rules for compliance.
D. Frameworks provide a high-level structure and collection of best practices (e.g., NIST CSF) but do not, by themselves, define specific mandatory rules for an organization.

1. ISACA, "Cybersecurity Audit Certificate Study Guide, 2nd Edition," 2022, Chapter 1, Section: "Cybersecurity Governance Components," defines standards as "Mandatory requirements that describe how policies will be implemented."

2. National Institute of Standards and Technology (NIST), "SP 800-12 Rev. 1, An Introduction to Information Security," October 2017, Section 4.2 "Policy, Standards, and Practices," states that standards are "mandatory activities, actions, rules or regulations."

3. Massachusetts Institute of Technology (MIT), "Information Security Policy (Policy 13.2)," defines standards as "mandatory requirements for hardware, software, technology, and process." This illustrates the common definition used in reputable academic institutions.