What are policies, standards, specifications, procedures and exceptions

Policy An Information Technology Policy is the highest level of the Information Technology (IT) Governance Standards documents. An IT Policy sets the direction, tone and limits for the enterprise and IT, and the IT Standards which are developed under the authority of the Policy. A Policy should seldom change. IT Policies require compliance; failure to comply may result in disciplinary action. Exceptions can only be approved by the CIO. A Policy focuses on desired results, not on the means of implementation.

Accountabilities:
Oversight of IT Policies is the responsibility of IT Governance. Policies must be approved by the Chief Information Officer and the Enterprise Policy Council.

Standard Information Technology Standard

Information Technology Standards are the most often used documents in the IT Policies and Standards Library serving as a reference for employees, contractors, consultants, and other persons.

An IT Standard:
• Defines requirements around a topic. The requirements may range from very specific (i.e., only 3DES and AES encryption algorithms may be used.) to broad (i.e., Web applications must check for common vulnerabilities).
• Provides requirements without stating dynamic details. When dynamic details are important, an IT Standard may identify a requirement for the existence of a Specification or Procedure to contain those details.
• Reviewed annually. The frequency of changes for IT Standards will vary with the maturity of the Standards.
• Exceptions to a Standard must be documented and approved based upon a defined IT Compliance process.

Accountabilities:
IT Standards may be written or updated by anybody competent to write on the subject. IT Compliance will review the proposed change. IT Standards and changes to IT Standards must be approved by the Standard Owner. Each IT Standard must be reviewed by the IT Standard’s Owner annually

Specification An Information Technology Specification:
• Defines, describes, illustrates, and discloses the details necessary to meet the requirements of an IT Standard
• Is often the result of a requirement from one or more IT Standards and receive direction from the IT Standards
• Normally considered subordinate to one or more IT Standards, but this is not a requirement
• Is at the same hierarchical level as an IT Procedure. The content of each may refer to and support requirements of the other
• Are intended to contain the dynamic details, such as may result from technology changes; such dynamic information is not appropriate for the more static IT Standard
• Contain details such as settings used for a server build or currently supported server configurations
• Are sufficiently detailed that an appropriately trained person could understand and use the IT Specification for a repeatable process
• Are most often directly related to the activities of an IT work group
• Are often used as a baseline to audit group’s work implementing and maintaining IT infrastructure devices such as servers, routers or firewalls
• Exceptions to an IT Specification must be documented as directed in the IT Specification or by the IT Compliance exception process

Accountabilities
IT Compliance is responsible for deciding whether the details of an IT Specification are more appropriate for an IT Standard.

IT Specifications or Changes to IT Specifications:
• Must be authored by someone with sufficient competency to ensure that the requirements are appropriate
• Must be approved by the Manager responsible for implementation of the IT Specification
• Must be reviewed annually by the IT Specification owner

Procedure An IT Procedure:
• Defines an IT process used to complete an identified task
• Is frequently the result of a requirement from one or more IT Standards
• Receive direction from the IT Standard
• Normally considered subordinate to one or more IT Standards, but this is not a requirement
• Is at the same hierarchical level as a Specification
• The content of IT Procedures may refer to and support requirements of other IT Procedures
• Contain the details of internal processes such as the process for ordering hardware or the process for a firewall change
Accountabilities

The accountabilities of IT Compliance, IT Standard Owners, and IT Managers are the same as those for a Specification