Standard
Definition
A document that translates a policy requirement into specific, measurable criteria. For example, a password policy may require strong authentication; the accompanying standard specifies minimum length, character complexity, and rotation interval. Approved by the CISO or information security steering committee.
- Sits below
- Policy in the governance hierarchy
- Function
- Converts a policy requirement into measurable criteria
- Approval
- CISO or information security steering committee
- Example
- Minimum password length, complexity, rotation interval
Common questions
How does a standard differ from a guideline or a procedure?+
A standard is mandatory and measurable, such as a required password length. A guideline is a recommended practice that allows discretion. A procedure sits below both and spells out the exact steps to meet the standard, such as how to reset a password in a specific system.
Who is responsible for keeping a standard current?+
Ownership typically sits with the CISO or the security steering committee that approved it, and standards are reviewed on a set cycle or whenever the underlying policy or the threat environment changes enough to make the existing criteria inadequate.
Related terms
- Document Control
- The systematic management of all procedural documents in a quality management system, ensuring that the current approved version is in use, all...
- Information Security Policy
- A high-level governance document that states what the organisation intends to achieve in protecting information, assigns accountability to roles, and sets the...
- Operating Effectiveness
- The assessment of whether a control has consistently functioned as designed over the audit period. Requires evidence of actual operation, such as...
- Policy Exception
- A formal, time-bounded approval to deviate from a policy or standard requirement when the standard control is not achievable. Exceptions must be...
- Procedure
- A step-by-step operational instruction that tells a specific role how to carry out a task in conformance with the relevant standard. Procedures...