RANGER CompTIA Security+ (SY0-701) · chapter 21 of 27
Month 7: Rules of the house
In this chapter Objectives 5.1
Objective 5.1
The document stack
Policies
A policy is a high-level, mandatory statement of management intent: what must happen and why, approved by leadership. CompTIA lists:
- Acceptable use policy (AUP): what users may and may not do with company systems.
- Information security policies: the overall security rules of the organization.
- Business continuity and disaster recovery policies: keeping the business running and restoring IT after a disaster.
- Incident response policy: who handles incidents and how they are reported.
- Software development lifecycle (SDLC) policy: security built into every phase of building software.
- Change management policy: how changes are requested, approved, tested and rolled back.
Standards, procedures, guidelines
Standards are mandatory, specific requirements that support a policy: password standards (length, MFA), access control standards, physical security standards (badges, locks), encryption standards (AES-256, TLS 1.2+). Procedures are step-by-step instructions: the change management procedure, onboarding/offboarding checklists, and playbooks (step-by-step responses to a specific incident type). Guidelines are recommendations: helpful advice that is not mandatory.
Exam tip Memory trick: Policy = why (must). Standard = what exactly (must). Procedure = how, step by step (must). Guideline = should (optional).
External considerations; monitoring and revision
Governance must reflect the outside world: regulatory rules (agency requirements), legal obligations (laws and contracts), industry standards (PCI DSS for cards), and the scope of the law: local/regional (state or province), national and global (laws like GDPR that reach across borders). Monitoring and revision: review documents on a schedule and after major changes, incidents or new laws, so they never go stale.
Objective 5.1
Who governs and who owns the data
Types of governance structures
Boards (board of directors) set direction and are ultimately accountable. Committees (such as a security steering committee) handle specific areas and report up. Government entities run governance for public agencies and set rules others must follow. Centralized governance makes decisions in one place (consistent); decentralized governance lets business units or sites decide (flexible, less consistent).
Roles for systems and data
Four roles you must not mix up:
- Owners: senior people accountable for a data set or system; they set its classification and who may access it.
- Controllers: decide why and how personal data is processed (the purposes and means).
- Processors: process personal data on behalf of a controller (a payroll service provider).
- Custodians/stewards: handle data day to day; custodians apply the controls (backups, permissions), stewards keep data accurate, labeled and compliant.
Exam tip Trap: the owner is accountable; the custodian does the hands-on protection. The IT admin who runs backups is a custodian, not the owner.
Check yourself 1A document says: "All laptops must use full-disk encryption with AES-256." It does not explain why, and it has no step-by-step instructions. What type of document is it?
- Policy
- Standard
- Procedure
- Guideline
Show the answer
Answer: B. Standard
A mandatory, specific technical requirement that supports a policy is a standard.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.