Free Governance Documents practice questions

The information security policy is the top-level document: it states leadership's commitment, sets the program's scope and objectives, assigns roles from the board down to every employee, and is the source of the security team's authority. The access control, acceptable use and incident response policies are issue-specific policies that sit beneath it, each governing one area.

The access control policy states who approves access (the data or system owner, not IT), how often access is reviewed and how quickly it is removed when someone leaves, so both findings break it. The information security policy creates the program and lists the policies beneath it but doesn't hold these specific rules, and the acceptable use policy governs how people use the systems they are allowed to reach.

The acceptable use policy defines what people may and may not do with company systems, and running cryptocurrency miners is one of the uses it typically prohibits. The information security policy sits above it and sets up the program rather than listing prohibited uses, the BYOD policy covers personal devices rather than company servers, and the access control policy governs how access is granted and removed.

A BYOD policy states what the company may see and do on a personal device: usually a selective wipe of corporate data but no access to personal photos or messages, with any full wipe agreed in advance, plus a deadline for reporting a lost device. The acceptable use policy is tempting because it says users have no expectation of privacy, but that applies to company systems, not personal devices, and the data disposal policy governs destroying company media once retention ends.

The incident response policy establishes the response capability and states what the team may do, such as isolating a production server without waiting for the system owner. The plan describes how the response runs and the playbook gives the steps for one type of incident, but both take their authority from the policy, which is the document that mandates and authorizes.

The data disposal policy sets how media is destroyed when hardware is retired, with approved sanitization methods and proof such as a certificate of destruction, so recoverable files on a resold laptop mean it failed. The retention policy is the tempting choice, but it decides when data may be destroyed, not how, and the clean desk policy covers papers and screens left unattended.

A guideline is advice, written with words such as should, recommended and consider, and nobody is sanctioned for departing from it. Policies and standards are mandatory, and a procedure is mandatory whenever you carry out the task it describes.

The encryption standard names approved algorithms and minimum protocol versions, so an external change such as an RFC deprecating old TLS versions is exactly what should trigger its update. The information security policy states broad intent that stays true when a protocol retires, and a vendor's implementation guide is outside advice the company doesn't control.

A runbook gives detailed operational instructions for one situation on one specific system, is often triggered by an alert, and frequently includes the exact commands. An SOP is the tempting choice, but it standardizes routine, recurring tasks done the same way by whoever is on shift, such as creating new accounts, and a playbook covers a whole type of incident with roles and decision points.

A reference architecture is a vetted design template for a common problem, showing the components and how they connect, which teams adapt rather than copy. An implementation guide explains how to deploy a product or control securely, a benchmark recommends configuration settings for a specific product, and a baseline is a mandatory configuration standard for one type of system.