ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A standard is an administrative control that defines specific, mandatory technical requirements-such as approved configurations, versions, or settings-to support and enforce higher-level security policies. In this scenario, documenting the exact AMI ID, patch level, and hardening settings establishes a uniform configuration each EC2 instance must meet, which is the purpose of a standard.

A security policy states overall management intent and goals but does not list detailed technical specifications.
A guideline offers recommended, but optional, advice rather than compulsory rules.
A procedure provides step-by-step instructions for performing a task but typically assumes the technical parameters (defined in a standard) are already known.
Therefore, issuing a standard is the most appropriate choice.