Unlike technical procedures that specify step-by-step instructions, cybersecurity standards define the mandatory security _______ that an organization must achieve.

### Why this is right The course definition describes standards as statements of what must be achieved in terms of security outcomes. Those outcomes are intended to fulfill the enterprise's stated security objectives. ### The concept The word **outcomes** is important because it distinguishes a standard from a specific implementation. The standard sets the required result. An organization determines the solutions and implementation methods it will use, then assesses whether those methods achieve the stated outcome. ### Terms - **Security objective**: A stated goal for protecting an organization's information or systems. - **Implementation**: The practical means used to meet a requirement. ### Remember Ask what the organization must achieve, rather than which product it must buy.