Unlike policies and procedures, which are mandatory in
nature and apply to all members of the organization, a standards document is
specific to the information system that it belongs, and sets forth goals for
implementation of that system.
As we all know, there’s more than one way to
implement a system, and keeping track of how your organization has chosen to
set up controls in each application is a great idea. Still, core concepts of security implementation at your organization can be identified and codified for each system, regardless of the endless variety.
These standards documents
can be as detailed or as high-level as you wish, but they will always be
specific to the system and will be advisory in nature. Make sure that your security teams can demonstrate how day-to-day activities relate to the code of behavior in each standard.
