What to Achieve, or How to Do It?

About this interactive

Policies and standards lay out what the organization is trying to accomplish and the quality it has to reach. A disaster recovery policy says the business will recover after a disaster; its standard says critical systems are back within eight hours. Neither says how. Procedures do. They are the step-by-step instructions for carrying something out: how to fail over to the recovery site, how to onboard or offboard someone, how to make a change, how to start a risk assessment. A large task breaks down into smaller procedures, and the collection of them is a playbook. The lesson's wire-transfer story shows why procedures matter. A scam nearly got paid because nothing stopped one person sending money on a request that looked real. The fix was a procedure with checks and balances: verify the request and have a second person approve it, separation of duty built into the steps. To sort a card, ask whether it tells you what has to be true, or tells you what to do, in order, to make it true. Every topic on these cards appears once each way.

What you'll learn

Tell a policy or standard, which says what to achieve and how well, from a procedure, which gives the steps for how to carry it out

Aligned to

CompTIA Security+

5.1 Summarize elements of effective security governance.

ISC2 CISSP

1.6 Develop, document, and implement security policy, standards, procedures, and guidelines

Key terms

Procedure: A detailed, step-by-step set of instructions for carrying out a specific task in alignment with policies and standards.
Security Policy: A formal document that defines an organization's security goals, rules, and responsibilities.
Playbook: A security playbook is a structured set of predefined response procedures for specific incident types, guiding analysts through detection, containment, eradication, and recovery steps in a consistent and repeatable manner.
Separation of Duty: A security control that divides critical tasks among multiple individuals to reduce the risk of fraud or error.

Topics

Procedures Security Policy Governance Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →