In the governance hierarchy described in the source, where do cybersecurity standards sit?

### Why this is right The source places standards between governance direction and operational implementation. They turn the outcomes set by strategy and policy into criteria that can guide requirements, design, procedures, and testing. ### The concept A governance hierarchy links business direction to day-to-day work. Standards specify what security outcomes must be achieved, while plans and procedures describe how teams will achieve them. Traceability connects these layers so managers and auditors can follow the rationale from business objectives to operational evidence. ### The other options - **B. Below testing and evaluation, with no link to policy**: testing checks implementation, while standards should be traceable to policy. - **C. Outside governance, as optional technical advice**: standards are a key governance instrument, not detached advice. - **D. Above business mission and strategy**: cybersecurity direction should be aligned with the business mission, not placed above it. ### Terms - **Governance hierarchy**: the connected layers that translate organizational direction into operational activity. - **Traceability**: the ability to follow a requirement back to its source and related obligations. ### Remember Policy gives direction, standards define outcomes, and procedures guide implementation.