Appearance
← CISM syllabus chapters

Domain 3 · Objective reference 3A4 · Chapter 16 of 35

Make policies and procedures operable

About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified

Session only. Enable saving or download a backup from this course’s hub.

Completion is self-reported and does not certify understanding.

See it · Try it · Recall it

Picture the topic

Remember this: Direction becomes useful when someone can perform it.

CISM · 3A4Policy and authority pyramid
Policy and authority pyramidRead from direction toward implementation. The width of a tier is visual emphasis, not a count of controls or authority. Policy: State intent and accountability. Standard: Define mandatory requirements. Procedure: Describe executable steps and evidencePolicyStandardProcedure
Read from direction toward implementation. The width of a tier is visual emphasis, not a count of controls or authority.
Visual preferences

Reduced-motion preferences are respected. Highlights guide attention; they do not represent measured traffic or elapsed time.

Explore the anchors

State intent and accountability.

Concept matching activity

Match this task or description to its concept:

Define mandatory requirements.

Choose a concept before checking the explanation.

A quick way to study this topic
  1. Hide the explanation and redraw these three anchors from memory.
  2. Explain the difference between the anchors in your own words.
  3. Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
  4. Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.

Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.

What this chapter explains

Management concept and decision mechanism

A policy sets direction, standards specify mandatory conditions, procedures explain execution and guidelines support discretionary choices. The program needs coherent ownership, versioning, approval, communication and review. Test whether documents are usable under actual workload and service conditions. A policy without resources or a working escalation route can encourage repeated exceptions and informal bypass. Integrate requirements into procurement, development, access administration and supplier management instead of leaving them in a security-only document library. Maintain exceptions with authorization, limits, safeguards and expiry.

Make expectations usable

A policy communicates an approved expectation. A standard provides specific mandatory requirements. A procedure describes how to perform an activity. A guideline gives recommended approaches. Organizations may use different document names; clarify which requirements are binding rather than relying only on the label.

For example, a policy can require protection of sensitive customer information. An access standard can define authorization and review requirements. A procedure can show how a manager requests and revokes access. A guideline can help staff choose an approved sharing method. These documents should work together and have owners, approval records, version history, and review dates.

Worked example

A remote-access procedure includes enrollment, device validation, support and an authorized exception route so staff are not forced into untracked workarounds.

Check your understanding

How can documentation be tested beyond asking whether it exists?

Show explanation

Observe a controlled execution, inspect approvals and outcomes, and check that staff can use the route during normal and exceptional conditions.

Source and study boundary

Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.