Security Principles, Risk and Professional Conduct · Lesson 3

Who Sets the Rule and Who Executes It?

4 min read

Lesson objectives

Distinguish a law, framework, policy, standard and procedure in a concrete security decision, and identify where authority and scope must be verified.

Governance comes before choosing a tool: who can accept risk, what is required and how will performance be shown? A law or regulation comes from a competent authority and depends on place, sector and effective date; a company mentioning it does not turn it into universal operating guidance. A framework organizes outcomes and shared language, but does not replace verification of a legal or contractual obligation. An organization adopts a policy to set expectations, responsibilities and boundaries, then translates it into more specific standards, such as an approved retention interval or access setting. A procedure gives the steps for implementing that standard in a particular environment. A contract may add requirements. If a general lesson conflicts with an applicable document, seek authorized review rather than interpreting law on your own.

Test each layer with a different question. For law, ask which jurisdiction, authority, effective date and data type apply. For a framework, ask which outcomes it organizes and whether it is voluntary or has been adopted under a binding rule. For policy, ask who approved it and whom it covers. For a standard, ask which measurable value or configuration is required. For a procedure, ask who takes each step, in which system and with what evidence of success. A document's title can mislead: a firm may call practical instructions a 'standard.' Read its content and authority. Do not present a fictional firm's policy as universal or a NIST guide as local legislation.

Example

Hypothetical training scenario in Muscat: the broad notice states a policy-like goal, the quarterly interval is a periodic standard, and extracting, comparing and recording are procedural steps. An automated alert may provide useful input, but it does not itself establish that account privileges suit current duties. The review therefore cannot be removed solely because the alert exists. An analyst asks the policy owner for a documented decision on any proposed interval change and presents evidence from the last cycle: account count, decisions, removals and dates. The city is fictional context, not a claim about Omani law. If the alert later includes owner-approved role review and records decisions, a tested procedure change may be proposed instead of silently dropping oversight.

CSF 2.0 can organize outcomes across Govern, Identify, Protect, Detect, Respond and Recover, but it does not mandate one implementation for every organization or exempt it from its rules. Link the chosen outcome to the organization's control, owner and verification record. When external text changes, verify its current edition before revising policy. For a real legal claim, ask the qualified team to establish its jurisdiction and application; do not fill the gap with a geographic generalization. The learner's task here is to classify document function and operational effect, not provide legal advice.

Exercise

Exercise 1 — 9 minutes. You receive five cards: (A) a public authority publishes a defined obligation for a stated scope; (B) an internal document requires service-account protection; (C) a technical limit prevents a service token from outliving an approved interval; (D) steps rotate the token and verify that the old one fails; (E) a framework classifies protection and response outcomes. Produce a governance hierarchy map, classify each card and state what card A alone cannot establish.

Check your answer

The inputs differ in authority and detail. A may be a law or regulation because a public authority issued it, but applicability requires jurisdiction, effective date and the people covered. B is an internal policy expectation for service accounts. C is a measurable technical standard. D is the procedure for implementation and testing. E organizes outcomes and is not automatically a legal mandate. The result is a chain from applicable authority to policy, standard and procedure, with the framework helping to organize it. Do not place the framework above law as an equivalent source of obligation.

Exercise

Exercise 2 — 9 minutes. The team finds 12 administrative accounts; two no longer have a clear business owner, and the previous cycle lacked a complete account list. Produce a three-step documented change decision: immediate action, evidence of a completed review and who may change the review interval. Does a generic alert message close the gap?

Check your answer

The inputs are 12 accounts, two without a clear owner and an incomplete earlier list. First, limit exposure through the organization's authorized process and establish ownership before leaving the two accounts privileged; preserve evidence. Second, extract the full list, match each account to owner, role and approval, and record 12 decisions plus the reason for removing or keeping the two. Third, submit any interval change to the authorized policy owner after testing alert coverage and effectiveness. A generic alert cannot repair the incomplete review or the missing ownership decisions. The case does not say whether an external requirement fixes the interval, so applicability must be checked before a final change.

Lesson summary

Distinguish a law, framework, policy, standard and procedure in a concrete security decision, and identify where authority and scope must be verified.

Report an error in this lesson

Lesson objectives

Lesson summary

Share this page