Which statement best differentiates procedures from policies and rules?

• A. Policies are more flexible than procedures
• B. Rules are less restrictive than policies
• C. Procedures tell you what not to do
• D. Procedures are more specific than policies and less restrictive than rules.

Answer: (D)

Procedures provide the exact, step-by-step way to carry out a task, while policies set broad directions and rules enforce specific restrictions. This makes procedures more specific than policies because they spell out how to do things, but less restrictive than rules because they describe practical methods rather than absolute prohibitions or mandates.

Think of it like this: a policy says what we aim to achieve or the boundaries we must operate within; a rule tells us a concrete prohibition or requirement; a procedure shows the actual sequence of actions to implement the policy. For example, a policy might state that data must be protected; a rule might require encryption at all times for certain data; a procedure would lay out the exact steps for classifying data, selecting the encryption method, applying it, and verifying access controls.