Which term describes a governance artifact that defines how policies are implemented across the organization?

• A. Security Requirements Traceability Matrix (SRTM)
• B. System-specific Policies
• C. Standard
• D. Stakeholders

Answer: (C)

A standard is the governance artifact that defines how policies are implemented across the organization. It takes policy requirements and translates them into concrete, enforceable rules that apply consistently everywhere, across all units and systems. By specifying exact controls, configurations, and practices (for example, approved encryption methods, password requirements, or access controls), a standard ensures everyone follows the same methods, making compliance, auditing, and security monitoring predictable and reliable.

The Security Requirements Traceability Matrix, while useful, maps each security requirement to its implementation across projects or systems to show coverage, not to define the uniform implementation across the whole organization. System-specific Policies tailor rules to a particular system rather than establishing enterprise-wide, standardized approaches. Stakeholders are the people involved in governance, not the artifact that defines how policies are carried out.