Standards provide mandatory requirements describing *how an organisation will carry out its information security [[Policies]]*. These may include the specific configuration settings used for a common operating system, the controls that must be put in place for highly sensitive information, or any other security objective. Standards are typically approved at a lower organisational level than policies and, therefore, may change more regularly. For example, the University of California at Berkeley maintains a detailed [document](https://security.berkeley.edu/minimum-security-standards-electronic-information) titled the *Minimum Security Standards for Electronic Information*. This document divides information into four **data protection levels** (DPLs) and then describes what controls are required, optional, and not required for data at different levels, using a detailed matrix. ![[Minimum Security Standards Example.png]] The standard then *provides detailed descriptions for each of these requirements* with definitions of the terms used in the requirements. For example, requirement 3.1 in the above figure simply reads “Secure configurations.” Later in the document, UC Berkeley expands this to read “Resource Custodians must utilise well-managed security configurations for hardware, software, and operating systems based on industry standards.” It goes on to define “well-managed” as including the following: - Devices must have secure configurations in place prior to deployment. - Any deviations from defined security configurations must be approved through a change management process and documented. A process must exist to annually review deviations from the defined security configurations for continued relevance. - A process must exist to regularly check configurations of devices and alert the Resource Custodian of any changes. The three elements of the information security policy framework are as follow. **Policy** sets out the high-level objectives of the security program and requires compliance with **standards**, which include details of required security controls. **Guidelines** provide advice to organisations seeking to comply with the policy and standards.” As you prepare your organisation's standards, you should pay particular attention to four types of standards: - **Password standards** set forth requirements for password length, complexity, reuse, and similar issues. - **Access control standards** describe the account life cycle from provisioning through active use and decommissioning. This policy should include specific requirements for personnel who are employees of the organisation as well as third-party contractors. It should also include requirements for credentials used by devices, service accounts, and administrator/root accounts. - **Physical security standards** establish the guidelines for securing the physical premises and assets of the organisation. This includes security measures like access control systems, surveillance cameras, security personnel, and policies regarding visitor access, protection of sensitive areas, and handling of physical security breaches. - **Encryption standards** specify the requirements for encrypting data both in transit and at rest. This includes the selection of encryption algorithms, key management practices, and the conditions under which data must be encrypted to protect the confidentiality and integrity of information.