Study. uk . com
  1. Home
  2. All questions
  3. Question 508

CISM study material · question 508 of 1000

NIST separates policy from procedure by function. Which pairing is correct?

  1. Policy is written by the central security team while a procedure is written by whichever business unit will have to carry the policy out in practice
  2. Policy is reviewed every year while a procedure is fixed once it has been issued and is then changed only by a formal exception
  3. Policy states the correct or expected behaviour; procedure describes who does what, in what steps, to what criteria
  4. Policy is technical and addressed to the engineers, while a procedure is managerial and addressed to their own line supervisors
Show the answer

Answer: C. Policy states the correct or expected behaviour; procedure describes who does what, in what steps, to what criteria

SP 800-50r1 states policies are clear and simple statements specifying the correct or expected behaviour of an entity, while procedures describe how policies will be implemented, including who will do what, the steps or phases, and defined criteria.

Source: NIST SP 800-50 Rev. 1 (NIST) — Sec. 2.2 Developing CPLP Policies and Procedures

Challenge yourself on this topic → Study as cards