Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Procedures, Guidelines and Acceptable Use
The lower levels of the pyramid
Policies and standards say what must happen. Procedures say exactly how, step by step, so different people get the same result. Guidelines help people choose well where no rule applies.
| Procedures | Guidelines | |
|---|---|---|
| Nature | Mandatory, step-by-step | Advisory, recommended practice |
| Scope | A specific task, e.g. granting access or restoring a backup | Situations needing judgement, e.g. spotting phishing |
| Owner | The process owner | Security or the relevant expert |
| Good ones have | Clear steps, roles, inputs and outputs, checked by someone who does the task | Practical tips with reasons |
Acceptable use policy
The acceptable use policy (AUP) is the rulebook every user follows. It typically covers:
- authorised use of systems and devices, and limits on personal use
- email and internet: what isn’t allowed, and how to report phishing
- data handling: classification rules, no company data in personal cloud storage
- credentials: never share them, use MFA, report compromise
- AI and new tools: approved tools only, no confidential data in public AI services
- monitoring and consequences: use may be monitored, and breaches have consequences
Users acknowledge the AUP when they join and periodically after. That acknowledgement supports accountability and disciplinary action. Stating openly that use may be monitored matters; secret monitoring can break privacy law and damage trust.
Keeping procedures alive
- Write them with the people who do the work.
- Test them, especially emergency and incident procedures.
- Review them after incidents, audits and system changes.
- Keep them version-controlled and easy to find when needed, including offline copies for emergencies.
Example. During a ransomware incident, the backup restore procedure refers to a server decommissioned a year earlier, and the restore takes two extra days. Afterwards, every recovery procedure is tested in the quarterly DR exercise and updated through change management.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Document with step-by-step instructions | A procedure |
| Document that isn’t mandatory | A guideline |
| Document every user signs when joining | The acceptable use policy |
| Who owns a procedure? | The process owner |
| Best way to keep procedures effective | Test and update them regularly |
In short
- Procedures are step-by-step instructions for carrying out a task consistently; they're mandatory for the people who perform them.
- Procedures are owned by the process owner and kept close to where the work happens.
- Guidelines are recommended practice; they're advisory and help people make good decisions where no rule fits.
- The acceptable use policy (AUP) sets rules for every user: systems, email, internet, data handling, credentials and now AI tools.
- Users acknowledge the AUP when they join and periodically after; it supports enforcement and accountability.
- Procedures must be tested and updated, especially those used in emergencies such as incident response.
Exam traps
- Guidelines are optional; procedures and standards are mandatory.
- Procedures written once and never tested fail when they're needed.
- An AUP nobody has acknowledged weakens disciplinary action.
- The AUP should state that use may be monitored; secret monitoring can break privacy law and trust.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Acceptable use policy
1 / 8