Professional Security Institute 16Hr Practice Test

In a security program, policy sets the rule or principle guiding decisions and defines what must be done and why. Procedure turns that guidance into concrete, step-by-step actions describing how to implement the rule, who does it, in what order, and with which tools. For example, a policy might require that all access to sensitive data be logged and regularly reviewed. A procedure would then specify exactly how to enable logging, which events are captured, how often reviews occur, who conducts them, and where the logs are stored. This distinction shows why the statement about policy being the rule and procedure detailing implementation steps is the correct one. The other options mix up roles or imply mischaracteristics—describing steps is what a procedure does, policy isn’t merely a list of steps, and policy and procedure are not the same nor is one optional by default.