Information security policies, standards, procedures and guidelines

Governance documents form a hierarchy, and the Certified Information Security Manager (CISM) exam often asks which document a statement belongs in. The hierarchy exists because different readers need different things: the board needs to state intent once and have it last, engineers need precise settings, and the people doing daily work need exact steps. Putting each kind of statement in the right document keeps the top layer stable while the lower layers change as technology and processes change.