Which term describes an information security governance component that describes how policies will be implemented within an organization?

Which term describes an information security governance component that describes how policies will be implemented within an organization?

• A. Security Requirements Traceability Matrix (SRTM)
• B. Steganography
• C. Standard
• D. System-specific Policies

Answer: (C)

Standards translate policy requirements into concrete, mandatory rules that govern how security is implemented across the organization. They specify exact controls, configurations, and evaluation criteria so everyone applies the same security measures, making enforcement and auditing consistent. For example, if a policy calls for strong access controls, the standard would mandate MFA, password complexity rules, rotation intervals, and how credentials are stored. This separation helps ensure that policy intent becomes measurable and actionable across all systems and teams. Other governance terms aren’t about the broad, organization-wide implementation: a system-specific policy tailors rules to one system rather than the entire organization, a requirements traceability matrix maps requirements to tests, and steganography is unrelated to governance.

Standards translate policy requirements into concrete, mandatory rules that govern how security is implemented across the organization. They specify exact controls, configurations, and evaluation criteria so everyone applies the same security measures, making enforcement and auditing consistent. For example, if a policy calls for strong access controls, the standard would mandate MFA, password complexity rules, rotation intervals, and how credentials are stored. This separation helps ensure that policy intent becomes measurable and actionable across all systems and teams. Other governance terms aren’t about the broad, organization-wide implementation: a system-specific policy tailors rules to one system rather than the entire organization, a requirements traceability matrix maps requirements to tests, and steganography is unrelated to governance.