Standards, Guidelines, and Procedures

Related to policies are standards, guidelines, and procedures. All of these documents are related to security policies and in fact support those policies. A standard is a general statement of the desired level of operation. For example, requiring 99.5% network uptime would be a standard. A guideline is a general suggestion on how to achieve some standard. Guidelines are broad and are sometimes optional (i.e., not mandatory). Finally, we have procedures. Procedures are specific instructions on how to handle a specific issue.