A company has written security advice, a formal requirement, and a checklist of task steps. How should an assessor classify these items, and what evidence should the assessor look for to determine whether each is compulsory?

### What a good answer covers - General, non-mandatory advice is a **guideline**. - A formal, mandatory statement for a defined area or task is a **policy**. - A checklist that gives detailed steps for accomplishing a task is a **procedure**. - Compulsory status should be assessed by distinguishing formal mandatory documents from recommendations. ### The concept Classification helps an assessor interpret what an organization expects. A guideline can be useful, but the material defines it as non-mandatory. Policies are mandatory and violations may lead to discipline. Procedures describe how to achieve a goal or mandate, so their steps may operationalize a requirement. Standards also impose mandatory rules or actions, but the scenario's formal requirement is most directly a policy if it applies to a specific area or task. ### Terms - **Checklist**: A list of steps or items used to guide task completion. - **Compulsory**: Required rather than optional. ### Remember Classify each item by its authority and by the work it performs.