Governance Documents: Policy, Standard, Procedure, and Baseline

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Governance Documents: Policy, Standard, Procedure, and Baseline

Key Takeaways Explain This Topic AI

Governance defines who has authority, how decisions are made, and how security aligns with business objectives.

Policies state management intent and required outcomes at a high level and are mandatory.

Standards define mandatory, measurable requirements that support a policy.

Procedures provide step-by-step instructions for repeatable work; guidelines are optional advice.

Baselines define the approved minimum secure configuration, and every system must be measured against them.

Last updated: June 2026

Why Governance Is on the Exam

Governance is the structure used to direct, control, and measure a security program. It defines decision authority, accountability, risk appetite, oversight, and alignment with business objectives. On CompTIA Security+ SY0-701 (max 90 questions, 90 minutes, passing 750 on a 100-900 scale, launched November 7, 2023), governance lives in Domain 5.0 "Security Program Management and Oversight," the largest exam domain at roughly 20 percent of scored items. Expect several questions that hand you a scenario and ask which document type is the best fit.

Governance documents form a deliberate hierarchy. Each layer answers a different question and has a different level of authority. Memorize the hierarchy because the wrong layer is the most common distractor.

Document Hierarchy

Document Authority Question it answers Example

Policy Mandatory What outcome does management require? All workforce identities must use multifactor authentication

Standard Mandatory What specific, measurable rule enforces the policy? Privileged accounts must use phishing-resistant FIDO2 MFA

Procedure Mandatory How exactly do I perform the task? Steps to enroll a user in the approved MFA platform

Baseline Mandatory What is the minimum approved configuration? Laptop baseline: full-disk encryption, EDR, 10-min screen lock, central logging

Guideline Optional What is recommended but not required? Prefer passphrases of 15+ characters

The distinction the exam tests hardest is policy versus standard versus procedure . A policy is durable and rarely changes; it states intent and is approved at the executive or board level. A standard is specific and changes as technology changes (TLS 1.2 today, TLS 1.3 next year) and is typically owned by an engineering or architecture function. A procedure is operational detail maintained by the team that performs the work. A baseline is a configuration snapshot you can audit a machine against, and any drift away from it is a finding.

A useful memory aid: policy = why, standard = what, procedure = how, baseline = the secure starting state. Guidelines are the only optional layer; everything above them is enforceable, and violating a mandatory document can be grounds for corrective action.

Scenario: Remote Access Governance

A company allows remote work but has inconsistent VPN and cloud settings. Leadership approves a remote-access policy ; the operational documents then support it.

Governance need Best document
State that remote access must be approved, authenticated, encrypted, and monitored Policy
Require MFA, device compliance, 15-minute session timeout, and logging Standard
Explain how the service desk enrolls a new remote user Procedure
Define approved VPN gateway settings and endpoint posture checks Baseline
Suggest preferred home-network practices for employees Guideline
Agreements and Specialized Policies

SY0-701 also names specific document types you must recognize by their acronyms. They are heavily tested as "which agreement" questions.

Document Purpose
AUP (Acceptable Use Policy) Defines what users may and may not do on company systems
SLA (Service-Level Agreement) Contractual performance/uptime commitments with a provider
MOU/MOA (Memorandum of Understanding/Agreement) Non-binding or binding statement of intent between parties
MSA (Master Service Agreement) Umbrella contract governing future work orders
NDA (Non-Disclosure Agreement) Protects confidential information shared between parties
BPA (Business Partners Agreement) Defines responsibilities and revenue/risk sharing between partners
SOW (Statement of Work) Specific deliverables, timeline, and milestones under an MSA
Ownership and Review

Every governance document needs an owner and a review cycle (commonly annual, or sooner after a major incident, audit finding, regulatory change, or technology shift). A policy with no owner becomes stale; a procedure no one updates produces inconsistent execution and audit failures. Required attributes include the document owner (accountable for accuracy), the approver (showing management authority), the effective date, the review date, the scope (who and what must comply), version history, and a defined exception process.

Without a version and effective date, an auditor cannot prove which requirement was in force at the time of an incident. SY0-701 frames many governance items around this lifecycle: a control that exists on paper but was never reviewed, owned, or measured is treated as ineffective regardless of how good its wording is.

Common Traps

Calling every document a "policy" when it is really a standard or procedure.

Writing a policy so detailed it becomes a procedure and must change constantly.

Creating a baseline but never measuring live systems against it (configuration drift goes undetected).

Publishing a standard with no exception process.

Confusing an SLA (uptime/performance) with an MOU (intent) or AUP (user behavior).

Exam Focus

If the answer must state executive intent, choose policy . If it must define a specific mandatory technical rule, choose standard . If it must tell someone exactly how to perform a task, choose procedure . If it defines the approved minimum configuration, choose baseline . If it merely recommends, choose guideline . For partner relationships, match the acronym: uptime equals SLA, intent equals MOU, confidentiality equals NDA.