Which items belong in a typical cybersecurity standards document according to the source? Select ALL correct answers.

### Why this is right - **Purpose and objectives** explain why the standard exists and what outcomes it seeks. - **Scope** identifies what is covered and what is outside the standard. - **Roles and responsibilities** identify who implements and oversees the requirements. - **Requirements** form the core description of what must be achieved. - **Compliance and audit approach** explains how adherence will be monitored and enforced. - **Exception management** explains how departures from the standard are approved. ### The concept The source also lists references, effective date, approving authority, dependencies, related external controls, and maintenance information. A testing and audit method is optional but recommended for clear assurance. ### The other options - **G. A guarantee of zero residual risk**: no standards document can guarantee that all remaining risk is eliminated. ### Terms - **Residual risk**: risk that remains after controls are applied. - **Exception management**: the process for reviewing and approving departures from a standard. - **RACI**: Responsible, Accountable, Consulted, and Informed, a way to clarify roles. ### Remember A usable standard explains its purpose, boundaries, owners, requirements, assurance, exceptions, and upkeep.