The four kinds
- Policy: what must happen and why. Short, stable, approved by management.
- Standard: the specific, measurable rule, such as a minimum password length.
- Procedure: how to do it, step by step, and who does each step.
- Guideline: advice on good practice, not mandatory.
How to tell where something belongs
- If it changes when a tool changes, it does not belong in a policy.
- If it says who does what in which order, it is a procedure.
- If you could fail an audit by not doing it, it should not be a guideline.
- If two documents say the same thing, one will end up wrong: keep it in one and refer to it.
Who approves what
Management approves policies. Process owners usually approve procedures and standards. Each document carries its owner, version, approval date and next review date.
Questions
- Does ISO 27001 require procedures?
- It requires documented information where the standard says so and where you judge it necessary. Annex A control 5.37 asks for documented operating procedures.
- Can one document hold both the policy and the procedure?
- In a small company, yes. Keep them as separate parts, though: the rules change less often than the steps.