In security governance frameworks, standards define 'what' must be achieved, whereas procedures specify '_____' to achieve it.

### Why this is right One of the source's principles is to stick to the WHAT. A standard should define the end-state objective and leave suitable implementation methods to the teams responsible for execution. ### The concept Outcome-focused standards support consistent security goals while allowing viable solutions for different systems and business settings. This does not mean implementation is unplanned. Plans, requirements, architecture, guidelines, and procedures explain how the outcome will be reached. ### Terms - **Outcome-focused**: centered on the result that must be achieved rather than a single prescribed method. - **Viability**: practical achievability in business and technical terms. ### Remember Be specific about the required result and practical about how teams achieve it.