Which of the following statements about policy is FALSE?

A well-written policy is a high-level, strategic document that defines security goals and states what is required, not how it should be implemented. Policies are intentionally broad and technology-neutral to remain relevant over time. The specific, tactical details of "how" to implement a policy are contained in separate, more granular documents such as standards (which mandate specific technologies or configurations) and procedures (which provide step-by-step instructions for a task). Including the "how" in a policy makes it too rigid, difficult to maintain, and blurs the line between strategic direction and operational execution.

A. Policies fundamentally define the rules and requirements for security, which constitutes the "what" that needs to be done.

C. This is a primary function of a security policy—to establish the mandatory framework for protecting an organization's information assets.

D. Policies provide clear guidance and documented support for employees, protecting those who follow the rules from arbitrary decisions or blame.

---

1. Peltier

T. R. (2005). How to Write a Security Policy. SANS Institute InfoSec Reading Room.

Page 3

Section "Policy

Standards

and Guidelines": "A policy is a statement of management’s intent. It is a high-level document that is technology-independent... A policy statement does not state how to implement the controls." This source directly contrasts policy ("what") with implementation details ("how").

2. University of California

Berkeley

Information Security Office. (n.d.). Glossary of Terms.

Definition of "Policy": "Policies are high-level statements of intent. They state the 'what

' not the 'how.' They are mandatory and usually technology and solution-agnostic."

Definition of "Procedure": "Procedures are detailed step-by-step instructions on 'how' to implement and comply with standards and policies." This university resource clearly separates the "what" (policy) from the "how" (procedure).

3. Carnegie Mellon University. (2017). Governing for Information Security. CISO Program Executive Education.

Module 2

"Policies

Standards

and Procedures

" Page 12: The document presents a hierarchy where Policies are at the top

defining "What we must do." Below this are Standards

defining "How we will do it consistently

" and Procedures

defining "The steps to do it." This academic courseware explicitly states that the "how" is outside the scope of a policy document.