What is the difference between a policy and a standard operating procedure (SOP) in security management?

• A. A policy states the required goal; an SOP provides step-by-step instructions to achieve it
• B. SOP provides the required goal; policy provides steps
• C. They are interchangeable
• D. A policy only applies to personnel

Answer: (A)

In security management, the main idea is to separate what the organization intends to achieve from how it will achieve it. A policy states the required goal and the rules or principles that govern behavior across the organization. It answers questions like what must be protected, who has authority, and what constraints exist. It’s high-level, broad, and designed to be stable over time.

An SOP, on the other hand, turns that goal into action. It provides the exact steps, order of operations, roles, tools, and timing needed to implement the policy consistently. SOPs are detailed, process-focused, and typically updated as procedures or technologies change. For example, a data protection policy might set the goal of safeguarding customer data, while the corresponding SOP would specify how to grant access, perform authentication, encrypt data, log activity, and respond to incidents.

That’s why the correct choice is best: it captures the relationship where the policy defines the goal and the SOP provides the step-by-step instructions to achieve it. The other options misstate the roles—SOPs don’t set goals, and policies aren’t mere lists of steps or only applicable to personnel; they guide the organization as a whole.