(ISC)2 Certified in Cybersecurity Practice Exam

What can be considered the backbone of an organization’s security framework?

1. Guidelines

2. Policies

3. Standards

4. Procedures

The correct answer is: Policies

The correct choice is policies because they serve as the foundational component of an organization's security framework. Policies establish high-level principles and directives that dictate the organization's approach to managing security-related matters. They provide a clear framework for decision-making and set the expectations for behavior and practice within the organization, serving as a guiding document for all security initiatives. Policies are essential because they unify the organization's security efforts under a common set of objectives and rules. This ensures compliance with legal and regulatory requirements, which is crucial for organizational integrity and risk management. They also facilitate a culture of security awareness and responsibility across all levels of the organization. While standards, guidelines, and procedures are also important components of an effective security framework, they are built upon the foundation provided by policies. Standards define specific requirements and criteria to be met, guidelines offer recommended best practices, and procedures outline the step-by-step processes to achieve compliance with policies and standards. Thus, policies form the backbone because they not only inform the creation of standards, guidelines, and procedures but also ensure that all these elements are aligned with the organization's overall security strategy.