Lesson 2.29: Keeping a policy framework alive
Policies say what must be true, standards make it measurable, procedures say how to do it. Over the years the documents drift: reviews are missed, owners leave, a standard points to a policy that was retired, and a procedure quietly contradicts the standard above it. Auditors and attackers both find those gaps. In the lab you audit Northwind's policy register: overdue reviews, documents without owners, broken parent links and rules that conflict between levels, then write the actions.
19 min
You will learn to
- Explain the policy, standard and procedure hierarchy
- Find overdue reviews from dates and cycles
- Find documents without owners
- Find broken parent links
- Find conflicting rules between levels
Key terms
- Policy
- A short, management-approved statement of intent and principles.
- Standard
- Measurable mandatory requirements that implement a policy.
- Procedure
- Step-by-step instructions to meet a standard.
- Review cycle
- How often a document must be reviewed and re-approved.
- Document hierarchy
- Lower documents implement higher ones and may be stricter, never weaker.
← KPIs and KRIs that drive decisions · All lessons · Benchmarking against peers without fooling yourself →