ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A security policy is a brief, high-level statement of management's intent and overall requirements. It establishes mandatory rules (in this case, that MFA is required for all remote administrative access) without prescribing the exact technology or step-by-step process to achieve them. A standard would specify the exact technologies or configurations to satisfy the policy, a procedure would provide detailed instructions for implementing the requirement, and a baseline would define the minimum technical settings to be applied uniformly. Because the document merely states what must be achieved and carries executive authority, it is a policy.