← Back to news 27.09.2026 Series: Basic terms, part 5

A policy is not a guideline

Basic terms, part 5: policy, guideline, security concept and work instruction end up in the same folder in many organisations, often in the same document. BSI Standard 200-1 distinguishes them by purpose, audience and approver. Mix the levels and you get a policy nobody is allowed to change and instructions nobody reads.

Many organisations have a document titled "IT security policy". It runs to forty pages, opens with a sentence from management on the importance of information security, sets the minimum password length on page twelve and describes on page thirty how to restore the backup. Management signed it four years ago.

The document is not wrong. It is four documents in one, with four different purposes, audiences and approvers. That is why it never gets updated: every changed password rule would need a new signature from management.

Policy: management's commitment

The information security policy (German: Leitlinie zur Informationssicherheit) is the top-level document. BSI Standard 200-1 describes its purpose as follows (our translation):

"The core aspects of the security strategy are documented in the information security policy. The security policy is of central importance because it contains management's visible commitment to its strategy."

As minimum content, the standard lists the importance of information security, the link between security objectives and business objectives, the security objectives and core elements of the strategy, the assurance that management enforces the policy, and the organisational structure of the security process. Password lengths are not in it. A good policy has few pages, is adopted by management and changes only when strategy or organisation change.

ISO/IEC 27001 knows the same document as the information security policy under clause 5.2, established by top management.

Guideline: rules on one topic

Guidelines (German: Richtlinien) implement the policy for one topic and one group of people: use of e-mail and internet, mobile working, handling passwords, classifying information. The standard gives as examples security guidelines for the use of e-mail and internet and rules of conduct for staff when a security incident is suspected, with the aim of avoiding incidents caused by ignorance or wrong actions.

Guidelines are binding for the staff they address, and they change more often than the policy. ISO 27001 lists them in Annex A under 5.1 as topic-specific policies, in substance: defined, approved by management, published, communicated to those concerned, acknowledged by them and reviewed at planned intervals. So management has to approve, but not every password rule in the same charter as the strategy.

Security concept: the plan for the information domain

The security concept is not a rulebook for staff but a planning document. For an information domain, it describes which measures are implemented against which threats, based on structure analysis, protection requirements and modelling. The standard places it clearly (our translation):

"Security organisation and security concept are management's tools for implementing its security strategy."

Its readers are the information security officer, security management and the owners of target objects, not the workforce. It changes with the information domain, and it contains what a guideline never should: vulnerabilities, open measures, residual risks.

Work instruction: how it is actually done

The lowest level describes hands-on steps. Under technical documentation, the standard mentions instructions for installing IT applications, performing backups, restoring a backup or restarting after a power failure. It names the audience explicitly: experts. The yardstick is that the target state can be restored after a disruption within a reasonable time.

Work instructions change with every release and every new firewall. They should be approved by whoever is responsible for the subject, not by management, or they will be out of date at the next update.

Why the separation matters

The four levels differ in four characteristics: purpose, audience, approver and rate of change. Mix them, and every detail inherits the slowest approver. The password rule waits for management, so does the restore instruction, and the audit is shown a policy whose page thirty has been wrong for three server generations.

Conversely, a guideline without a policy loses its backing: anyone who breaks a rule cannot be pointed to a management decision that supports it. And a security concept distributed as a guideline to everyone publishes your own vulnerabilities on the intranet.

In isidaten, controlled documents therefore carry their own approval, a review cycle per document type and an acknowledgement per version, so that each level can keep its own rhythm.