CISSP Domain 1 – Policies, Standards, Guidelines & Procedures

One of the most common reasons CISSP candidates lose marks is confusing documents that sound similar but serve very different purposes.

Policies, standards, guidelines, and procedures are often spoken about together—but in CISSP, each one has a clear role, authority level, and intent.

This blog breaks them down in simple, real‑world terms, exactly the way CISSP expects you to reason during the exam.

Why This Topic Matters in CISSP

CISSP questions rarely ask you to define documents.

Instead, they test whether you can:

• Identify governance vs execution
• Choose the right document at the right level
• Understand mandatory vs recommended controls

Most mistakes happen when candidates pick a procedure where CISSP expects a policy, or miss guidelines entirely.

The Office Reality Analogy

Imagine an organisation trying to improve security.

Four different questions are asked:

1. What does the organisation expect everyone to follow?
2. What rules must systems comply with?
3. What recommended practices should people follow?
4. How exactly is the work performed?

Each question maps directly to a different document:

• Policy
• Standard
• Guideline
• Procedure

Understanding this mapping is the key to answering CISSP questions correctly.

Policy: What and Why

A policy is a high‑level statement of intent.

It answers:

• What is important?
• Why does it matter?
• What does management expect?

Examples

• Information Security Policy
• Acceptable Use Policy

Key Characteristics

• Approved by senior management
• Business‑driven
• Mandatory
• High‑level

CISSP Mindset

Policy sets direction, not steps.

If a CISSP question talks about governance, expectations, or organisational rules, policy is usually the answer.

Standard: The Mandatory Rules

A standard supports a policy by defining mandatory requirements.

Standards specify:

• Minimum requirements
• Approved configurations
• Consistent controls across the organisation

Examples

• Passwords must be at least 14 characters
• Approved encryption algorithms
• Secure configuration baselines

Key Characteristics

• Mandatory
• Specific
• Organisation‑wide

CISSP Mindset

Standards ensure consistency and compliance.

If a question includes words like must, required, or minimum, think standard.

Guideline: Recommended Practices

Guidelines are recommendations, not rules.

They exist to provide direction when flexibility is required.

Guidelines:

• Suggest best practices
• Allow professional judgment
• Are not mandatory

Examples

• Passwords should avoid dictionary words
• Developers should follow secure coding best practices
• Administrators should review logs regularly

CISSP Mindset

Guidelines support decision‑making when strict rules don’t fit.

If a CISSP question mentions recommended, suggested, best practice, or optional, the answer is usually guideline.

Procedure: How to Do It

A procedure explains step‑by‑step how a task is performed.

Procedures answer:

• How is something done?
• Who does it?
• In what order?

Examples

• User onboarding steps
• Incident response steps
• Backup execution steps

Key Characteristics

• Very detailed
• Task‑specific
• Operational

CISSP Mindset

Procedures guide day‑to‑day execution, not governance.

The Hierarchy CISSP Cares About

CISSP expects you to understand this order clearly:

Policy → Standard → Guideline → Procedure

• Policy sets direction
• Standards define mandatory rules
• Guidelines provide flexible recommendations
• Procedures explain execution

If a CISSP question asks what should be created first, the answer is almost always policy.

How This Appears in CISSP Questions

CISSP questions typically describe a scenario and ask:

• What should management establish?
• What document provides guidance without enforcement?
• What ensures consistent implementation?

Exam Technique

1. Identify the level (governance or operations)
2. Look for mandatory vs recommended language
3. Choose the document that matches the intent

This approach removes ambiguity from many questions.

One‑Line Takeaway

Policy sets direction.
Standards enforce rules.
Guidelines recommend best practices.
Procedures explain steps.

🎧 Listen to the Podcast

This blog is part of the CISSP Blog & Podcast Series on PK’s Chronicles.

If you prefer audio learning, listen to the companion podcast episode where this topic is explained in a 10‑minute, concept‑first format.

Listen on Spotify: Search for “PK’s Chronicles ”

Each episode focuses on how CISSP wants you to think, not memorisation.