What is the difference between a policy and a standard?
While cybersecurity policies and standards are designed to work together, there are differences that matter. Organizations use policies to communicate their security goals and values, while standards provide the baseline technical or operational criteria to meet those goals.
A policy is a high-level statement of management intent that formally establishes requirements to guide decisions and achieve rational outcomes. A policy is intended to come from the CEO or board of directors that has strategic implications. However, a standard is a formally-established requirement in regard to a process, action or configuration that is meant to be an objective, quantifiable expectation to be met (e.g., 8-character password, change passwords every 90 days, etc.).
In reality, no one should ever ask for an exception to a policy. Exceptions should only be for standards when there is a legitimate business reason or technical limitation that precludes a standard from being followed (e.g., vulnerability scanning exception for a "fragile" application that breaks when scanned by the default scanning profile). It is important that if a standard is granted an exception, there should be a compensating control placed to reduce that increased risk from the lack of the required standard (e.g., segment off the application that cannot be scanned for vulnerabilities).
A policy is a high-level, formal statement that defines an organization’s principles, rules, or intentions regarding a particular area such as cybersecurity, privacy, or acceptable use. Policies set the “what” and “why”, they provide overarching guidance and reflect management’s commitment to goals, compliance, or risk management. For example, a data protection policy might declare that all sensitive data must be encrypted.
A standard, on the other hand, provides more detailed, specific and measurable requirements that help enforce a policy. Standards define the “how” by specifying mandatory technical or procedural controls that must be followed to comply with the policy. For example, an encryption standard might specify the exact algorithms, key lengths and protocols that must be used.
Other differences between policies and standards include:
- Level of detail: Policies are broad and principle-based, while standards are precise and prescriptive.
- Purpose: Policies guide decision-making and set expectations, while standards ensure consistency and enforceability.
- Audience: Policies are often aimed at all employees and stakeholders, while standards target technical teams and implementers.
- Flexibility: Policies allow for interpretation and judgment, while standards require strict adherence.