Exam CISM topic 1 question 129 discussion

Answer is B. --- 1) A policy is a high-level statement of management intent that formally establishes requirements to guide decisions and achieve rational outcomes. A policy is intended to come from the CEO or board of directors that has strategic implications. ---- 2) A Standard is a formally-established requirement in regard to a process, action or configuration that is meant to be an objective, quantifiable expectation to be met (e.g., 8 character password, change passwords every 90 days, etc.) --- Source: https://www.complianceforge.com/faq/word-crimes/policy-vs-standard-vs-control-vs-procedure

it is C. because it is a written procedure for user access controls. see below:A document detailing minimum security controls required for users is typically called a "User Access Control Procedure" or "Minimum Security Standards for User Accounts"; it outlines the essential security controls that must be implemented for all user accounts within an organization, specifying requirements like strong password complexity, regular password changes, access level limitations based on roles, and proper account deactivation procedures.

B. Standards

Standards provide specific, mandatory requirements that must be followed in order to comply with a policy or to achieve a specific level of security.

B is my answer. It is sometimes difficult to see the difference between policy and standards. Knowing the definition of each, and even having examples in your brain doesn't always help. I always get confused!

I think its Policies