Cisco Certified Support Technician (CCST) CybersecuritySecurity PrinciplesHard
A cybersecurity team is tasked with implementing a comprehensive security policy framework. They understand that policies alone are insufficient and must be supported by practical guidelines. Which element defines the mandatory, high-level statements that dictate the organization's overarching security philosophy and requirements?
- APolicies
- BStandards
- CBaselines
- DProcedures
Show answer & explanationAnswer & explanation
Correct answer: A. Policies
Policies are high-level, mandatory statements that express management's intent and expectations regarding security. They dictate the 'what' and 'why' of security within an organization, forming the foundation of the security program.
Why the other options are wrong
- B. Standards provide specific requirements for technology or processes, supporting policies.
- C. Baselines are minimum security configurations for systems, a type of standard.
- D. Procedures are step-by-step instructions for performing tasks, implementing standards and policies.
Security Policy
A high-level statement issued by management that outlines the organization's security goals and rules.
- Mandatory and foundational.
- Defines 'what' and 'why' of security.
- Supported by standards, baselines, and procedures.
Memory trick: Policies are the law, Standards are the rules, Procedures are the steps.