@derb the Why bothers me; I see policy and standard both as What’s. Both describe “doing something”, but as Strategy vs tactic.

My favorite policy voice narrates what we do as seen from a mile up, standards are what it looks like on the ground.

Policy is ‘we will accomplish x’ (strategy, abstraction, a result, but arguably ‘doing something’)

Standard is ‘we will do xyz’ (implied: to accomplish x), so it’s a control or tactical statement, and your ‘do what’ of the policy).

#infosec #grc