OpenCyber Academy
Bachelor's · Chapter 13 · English
Course code: OCA-095Chapter 13: OCA-095-C013

Chapter 13 — Policies and standards

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Three levels"]
  N2["13.2 Drafting a policy"]
  N3["13.3 Standards in detail"]
  N4["13.4 Keeping documents usable"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Three levels"]
  N2["13.2 Drafting a policy"]
  N3["13.3 Standards in detail"]
  N4["13.4 Keeping documents usable"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]
[Learning outcomes]
    |
    v
[13.1 Three levels]
    |
    v
[13.2 Drafting a policy]
    |
    v
[13.3 Standards in detail]
    |
    v
[13.4 Keeping documents usable]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) distinguish policies, standards and procedures; (2) draft a data policy; (3) keep policy documents usable.

13.1 Three levels

Amara learns that a policy states principles and responsibilities, such as data must have a named owner. A standard sets specific requirements, such as every loyalty record must have a valid store code from the reference list. A procedure describes steps, such as how to request a new store code. Keeping these levels separate lets policies stay stable while standards and procedures change more often. She finds Harbourline's existing documents mix all three in long, rarely read texts. Amara proposes splitting them.

13.2 Drafting a policy

Amara drafts a two-page data policy for Harbourline: purpose, scope, principles, roles, compliance and review. Principles include data have named owners, quality is measured and reported, personal data are used only for stated purposes and retention follows the schedule. She asks owners to comment and incorporates their suggestions. The governance group approves the policy. She learns that a short policy that people read is more effective than a long one they ignore. Her draft is shorter than any previous Harbourline policy on data.

13.3 Standards in detail

Under the policy, Amara writes a data quality standard for loyalty data: required fields, allowed values, formats and target completeness levels. She bases the measurement approach on ISO 8000-8, which emphasises that quality claims should state how they were measured. Each requirement links to a check that can be run automatically. She notes that standards without checks become aspirations, while standards with checks can be monitored and enforced through regular reports. The standard is published alongside the policy and reviewed by the loyalty owner each year.

13.4 Keeping documents usable

Amara proposes a single online location for policies, standards and procedures, each with an owner, version, review date and plain summary. Documents not reviewed for two years are flagged. She tests findability by asking store staff to locate the procedure for correcting member addresses; most succeed within a few minutes. Dr. Lindqvist reminds her that documents are tools for people doing work, so usability matters as much as content. Two staff fail to find it, so the procedure title is changed to match the words staff actually use.

Worked example

Amara separates policy, standard and procedure, drafts a two-page approved policy, writes a measurable loyalty data standard and organises documents in one place with owners and review dates.

Synthetic case. Documents are synthetic; ISO 8000-8:2015 is real.

Errors and limits

Long policies mixing levels go unread; separate and shorten.

Exercises

Worked answers

EX037. Every loyalty record must have a valid store code.

EX038. Two pages.

EX039. When not reviewed for two years.