What should a cybersecurity standard primarily state?

### Why this is right The source defines a standard in terms of what security outcomes must be achieved. It normally does not prescribe the implementation method or specific solution. ### The concept Keeping a standard focused on the outcome allows different teams to use workable methods while still meeting the same security objective. Plans, architecture, and procedures describe implementation. The standard should remain clear enough to test and audit. ### The other options - **B. Every technical step an implementer must follow**: this belongs in implementation plans or operational procedures, not usually in the outcome-focused standard. - **C. The name of every vendor that may supply a solution**: standards normally avoid tying outcomes to a particular vendor. - **D. A promise that no incident can occur**: standards set requirements; they cannot guarantee that incidents will never happen. ### Terms - **Cybersecurity standard**: a statement of required security outcomes. - **Operational procedure**: instructions describing how work is done. ### Remember A standard says what must be achieved; implementation documents explain how.