Domain 1 · Objective reference 1.3 · Chapter 3 of 19
Laws, frameworks, policies, standards and procedures
About 5 minutes · ISC2 CC outline effective 1 September 2026
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Policy says what; procedure says how.
Explore the anchors
Management direction and intent.
Concept matching activity
Match this task or description to its concept:
Mandatory measurable requirements.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Know the authority behind a requirement
- Turn documents into accountable work
Know the authority behind a requirement
A law or regulation can impose obligations on covered entities and activities. A contract can establish duties between parties. A voluntary framework organizes outcomes or practices; adoption does not automatically prove legal compliance. The relevant entity, processing, geography, version and commencement date matter. In an Indian regulatory example, use the official instrument and authorized legal or compliance interpretation rather than applying one reporting deadline to every organization.
An information-security policy states management direction and required behavior. A standard specifies mandatory conditions that support the policy. A procedure explains how to perform a task. Guidance offers a recommended approach where discretion is permitted. These documents should agree, have owners and versions, and be accessible to the people who must use them.
Turn documents into accountable work
A requirement needs implementation and evidence: who approves it, who operates the control, who reviews it and who decides exceptions? For access removal, a policy might require timely revocation, a standard might define approved time limits by risk, and a procedure might explain the application and session checks. Evidence includes approvals and verified outcomes, not only acknowledgment of the document.
An exception should identify the affected requirement, business reason, scope, exposure, safeguards, authorized approver and expiry. Repeated exceptions can reveal an impractical standard or an unfunded control. AI tools are subject to the same governance discipline: approved purposes, permitted data, access, review and escalation need explicit ownership. Do not treat a supplier’s acceptable-use statement as the organization’s complete governance process.
Worked example
A company requires secure remote access. Its standard names approved authentication and device conditions; its procedure explains enrollment and support. An employee who cannot meet the conditions uses the exception route rather than permanently bypassing the control.
Check your understanding
A supplier claims its platform follows a well-known framework. Does that establish the customer’s regulatory compliance?
Show explanation
No. Check the framework’s scope, relevant obligations, supplier assurance and retained customer responsibilities. A framework claim is evidence to evaluate, not a universal compliance conclusion.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.