Which statement correctly distinguishes policy from procedure in a security program?

Which statement correctly distinguishes policy from procedure in a security program?

• A. Policy states the rule or principle; procedure describes steps to implement it.
• B. Policy describes steps; procedure states the rule.
• C. Policy is optional; procedure is mandatory.
• D. Policy and procedure are the same.

Answer: (A)

In a security program, policy sets the rule or principle guiding decisions and defines what must be done and why. Procedure turns that guidance into concrete, step-by-step actions describing how to implement the rule, who does it, in what order, and with which tools. For example, a policy might require that all access to sensitive data be logged and regularly reviewed. A procedure would then specify exactly how to enable logging, which events are captured, how often reviews occur, who conducts them, and where the logs are stored. This distinction shows why the statement about policy being the rule and procedure detailing implementation steps is the correct one. The other options mix up roles or imply mischaracteristics—describing steps is what a procedure does, policy isn’t merely a list of steps, and policy and procedure are not the same nor is one optional by default.

In a security program, policy sets the rule or principle guiding decisions and defines what must be done and why. Procedure turns that guidance into concrete, step-by-step actions describing how to implement the rule, who does it, in what order, and with which tools. For example, a policy might require that all access to sensitive data be logged and regularly reviewed. A procedure would then specify exactly how to enable logging, which events are captured, how often reviews occur, who conducts them, and where the logs are stored. This distinction shows why the statement about policy being the rule and procedure detailing implementation steps is the correct one. The other options mix up roles or imply mischaracteristics—describing steps is what a procedure does, policy isn’t merely a list of steps, and policy and procedure are not the same nor is one optional by default.