Exam CISSP topic 1 question 355 discussion

Pretty sure policy > standard

Answer C) https://complianceforge.com/grc/hierarchical-cybersecurity-governance-framework/

This question doesn't say which way the order goes, and I think "organization principle" is missing letters or should be something else. I searched extensively and found this hierarachy, with Policy on the bottom as the widest and Guideline on top: https://www.linkedin.com/pulse/information-security-policy-hierarchy-branden-rowe/ So I'm thinking A. https://informationshield.com/2014/10/27/security-policies-standard-and-procedures-whats-the-difference/

Standard > Policy , answer is correct

Org. Principle- Policy- Standard- Guideline...

C. Organization principle, policy, standard, guideline

I believe by Organization Principles they means Security Governance Principles. If so, then yes it comes before the policy. Governance Principles is used to write the security policy.

Regulations and legislations are #1. Then the have corp. policy, standards, procedures, and guides.

https://frsecure.com/blog/differentiating-between-policies-standards-procedures-and-guidelines/

it is C

Reference: https://www.linkedin.com/pulse/understanding-hierarchy-principles-policies-standards-wally-beddoe

policy standards guidelines so C

B is the closest. Information Security Policies are high-level business rules that the organization agrees to follow that reduce risk and protect information. They define “what” the organization is going to do and often “who” is going to do it. Information Security Standards provide more specific details that enable policies to be implemented within the organization using different technologies. For example, an Information Disposal Standard would define how various type of media are destroyed to implement a policy. Information Security Procedures are step-by-step instructions that people will follow to implement policies (or even standards.) Procedures provide the “how” – where an information security control is translated into a business process.