What are the differences between a policy, a standard, and a practice? What are the three types of security policies? Where woul

Question

1 month ago

15

d each be used? What type of policy would be needed to guide use of the Web? E-mail? Office equipment for personal use?

1 answer:

maria [879] · Answer 1 · 2026-02-27T13:50:43+03:00

Answer:

Policy: Defines the written guidelines that outline acceptable behavior.
Standard: Represents a comprehensive directive outlining what actions are required to adhere to the policy.
Practice: Illustrates specific actions that comply with the established policy.

Enterprise Information Security Policy (EISP): A high-level document that outlines the strategic approach, scope, and objectives for the organization’s security framework. Use: It aligns with the organization's mission, vision, and overarching security strategy.

Issue Specific Security Policy (ISSP): A targeted organizational policy that conveys detailed instructions for members regarding the usage of specific resources, processes, or technologies. Use: Supports operational functions and guides employees in the correct utilization of these technologies and processes.

System Specific Security Policy (SysSP): These are organizational policies that typically function as standards or procedures for system setup or maintenance. They can be divided into managerial guidance and technical specifications, though they may also be combined into a single document. Use: Serves as a guideline for system configuration and upkeep.
An ISSP policy would be required to manage internet, email, and personal use of office equipment.