Governance document types
The kinds of document the library holds, in order of precedence (highest authority first). When two documents conflict the higher one wins: an external regulation overrides internal documents, a policy sets the intent that standards, procedures and SOPs implement in ever-greater detail, and only a best practice is advisory rather than mandatory.
| # | Type | Force | Definition | Answers | Typical approver | Examples |
|---|---|---|---|---|---|---|
| 1 | Regulation | External - mandatory | An external law, rule or contractual mandate the organization is legally required to comply with. | What we must obey (external) | Imposed by an external authority; the organization maps its controls to it | HIPAA, PCI DSS, FISMA, GDPR, SOX |
| 2 | Policy | Mandatory | A high-level statement of management intent and direction - the top internal governance document; everything below implements it. | Why, and what we require | Executive leadership / board (e.g. CISO, ratified by the risk committee) | Information Security Policy; Acceptable Use Policy |
| 3 | Standard | Mandatory | Specific, measurable, mandatory requirements that make a policy enforceable. | What, specifically | CISO / control owner | TLS 1.2+; passwords >= 14 chars; the SP 800-53B baseline for a system |
| 4 | Procedure | Mandatory | Ordered, mandatory instructions for carrying out a policy or standard. | How, step by step | Process owner | Incident Response Plan; access-provisioning procedure |
| 5 | SOP | Mandatory | A Standard Operating Procedure: a detailed, repeatable runbook for one specific task - the most granular procedure. | How, exactly, every time | Operations / control owner | Zero-day emergency activation runbook; just-in-time PAM access SOP |
| 6 | Best Practice | Recommended (advisory) | Recommended, non-mandatory guidance from industry experience; adopted at each team's discretion where not already mandated. | What is recommended | Control owner (advisory) | CIS Benchmarks; the CrowdStrike front-lines recommendations |
ⓘ Rule of thumb: Regulation → Policy → Standard → Procedure → SOP are all mandatory and increasingly specific; a Best Practice is recommended guidance you adopt where it is not already required. Every document maps to NIST CSF and rolls up on the compliance view.