TechKnowSurge
ISC2 CISSP 1.6 NIST 800-53 PL-4 CompTIA Security+ 5.1 NIST NICE K0645
TechKnowSurge Catalog Videos Guidelines
VideoSecurityFree

Guidelines

Procedures define the steps required to complete a task, while guidelines provide supporting guidance for judgment calls and decision-making that procedures cannot fully anticipate. Together, they help practitioners navigate variability and make informed choices within a process.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Procedures define the necessary steps to complete a task or process, providing a structured path from start to finish. However, procedures cannot anticipate every variable or edge case a practitioner will encounter in real-world application. That is where guidelines serve a distinct and complementary role, offering guidance that helps individuals exercise sound judgment when the procedure alone does not specify what to do. Guidelines are especially useful in two practical scenarios. The first is when unexpected situations arise mid-process and a judgment call is required that falls outside the explicit scope of the procedure. The second is when a process allows for more than one valid approach and the practitioner needs criteria to evaluate which option better fits the circumstances. In both cases, guidelines draw on established experience and best practices to inform the decision without removing the practitioner's responsibility to assess the situation. It is important to understand that guidelines do not make decisions on behalf of the user. They frame the considerations, surface relevant factors, and provide context drawn from prior experience or domain knowledge. The final decision still depends on the individual applying that guidance to their specific situation. This distinction reinforces why both procedures and guidelines are necessary components of a complete operational framework rather than interchangeable documents.

What you'll learn

What's covered

Procedures vs Guidelines

Aligned to

ISC2 CISSP
1.6 Develop, document, and implement security policy, standards, procedures, and guidelines
NIST 800-53
PL-4 Rules of Behavior
CompTIA Security+
5.1 Summarize elements of effective security governance.
NIST NICE
K0645 Knowledge of standard operating procedures (SOPs)

Key terms

Procedure
A detailed, step-by-step set of instructions for carrying out a specific task in alignment with policies and standards.
Guidelines
Recommended practices that provide flexible guidance for achieving security objectives, as opposed to mandatory requirements.

Topics

Organizational Policy Procedures Guidelines Decision Making Security Governance Policy Framework

Transcript

A procedure outlines everything that we need to do to make something happen. However, there are times when we need a little extra guidance, and that's one thing that guidelines can do. Guidelines are there to give us guidance for what we need to do.

Where guidelines come in handy

One of the cases where guidelines really come in handy is different what-if scenarios. When we're working through a procedure, there are a lot of things that we could encounter, and what happens is we have to make some judgment calls on how to handle those situations, because we can't spell out every single little scenario. So it's helpful sometimes to have a little guidance to do that. If we had some guidelines to help us be able to make those decisions, we could do that. That's one of the use cases for guidelines.

Another use case for guidelines is maybe little tips and tricks on how we can improve the process. For instance, maybe there's a specific process that we have to follow, but there are certain aspects to it that you could do this way or do that way, and so maybe some guidelines help direct us on why we might want to choose one way or another.

An example

Here's an example where guidelines could come in handy. My son is buying a car right now, and he's making a decision on, do I want this car or that car? He's finding different cars that have a lot of these different ways to weigh it out, like: what is the mileage of the vehicle, what is the cost of the vehicle, is it the vehicle that he really wants, does it have the automatic transmission or the manual transmission? He's weighing out all of these details for what he really wants. Is it the right color?

He's coming to me for some guidance with that, and I can't really weigh those out for him. But what I can do is give him some guidance and guidelines for what I've used in the past: the experience that I've had with working with a dealer or private party, the experience that I had with buying older cars versus newer cars. I can give him some of that experience and that guidance to help him make the decision. But ultimately the decision is on his part, so these guidelines are only there to help him facilitate that decision-making process.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →