Security Policy, Standards, Procedures, Baseline, and Guidelines

Concept Focus

This governance stack translates business security direction into operational behavior. The article frames it cleanly: policy is the compass, standards and baselines are the guardrails, procedures are the road signs, and guidelines are the driving tips. :contentReference[oaicite:2]{index=2}

Security Policy

Policy captures senior management intent and strategic direction. It is reviewed and approved at leadership level, defines responsibilities and roles, outlines audit and enforcement expectations, sets compliance expectations, and establishes acceptable risk levels. It is mandatory. :contentReference[oaicite:4]{index=4}

Standards

Standards define what is required to implement policy. They are mandatory technical specifications, often tied to hardware or software choices, and help drive uniformity across departments while reducing total cost of ownership and supporting disaster recovery objectives. :contentReference[oaicite:6]{index=6}

Procedures

Procedures are step-by-step mandatory instructions for implementing policy and standards. Their purpose is consistency and accountability in execution. :contentReference[oaicite:8]{index=8}

Baselines

A baseline defines the uniform minimum acceptable security level used to implement a standard. It is commonly a technical hardening configuration, and exceptions require senior management sign-off. :contentReference[oaicite:10]{index=10}

Guidelines

Guidelines are optional recommendations and best practices. They help people comply more effectively, but they are not mandatory in the same way policy, standards, procedures, and baselines are. :contentReference[oaicite:12]{index=12}

Types of Policy

The article distinguishes between three common policy categories:

• Corporate-specific: enterprise-wide security policy
• System-specific: policy for a given platform or system
• Issue-specific: policy targeting a particular topic such as social media or acceptable use :contentReference[oaicite:14]{index=14}

Sample Governance Documents

Sample Policy — Password Policy

Enterprise intent around password rules and MFA requirements belongs at policy level because it expresses mandatory organizational direction. :contentReference[oaicite:15]{index=15}

Sample Standard — Secure Email Standard

• All confidential emails must use TLS encryption.
• Attachments are scanned by DLP before sending.
• Personal email accounts are not used for company work. :contentReference[oaicite:16]{index=16}

Sample Baseline — Windows 11 Baseline

• Enable BitLocker.
• Disable SMBv1.
• Require MFA on login. :contentReference[oaicite:17]{index=17}

Sample Procedure — Offboarding

• HR notifies IT of exit date.
• Disable accounts in AD.
• Revoke VPN and application access.
• Recover laptops, phones, and badges. :contentReference[oaicite:18]{index=18}

Sample Guideline — New Employee Security Checklist

• Use company VPN on public networks.
• Avoid storing files locally on laptops.
• Report suspicious emails immediately. :contentReference[oaicite:19]{index=19}