Certified Information Security Manager (CISM) — Question 1064

An organization has acquired a new system with strict maintenance instructions and schedules. Where should this information be documented?

Answer options

• A. Standards
• B. Procedures
• C. Guidelines
• D. Policies

Correct answer: B

Explanation

The correct answer is B, as procedures provide detailed instructions on how to perform tasks, including maintenance activities. Standards (A) typically outline required levels of performance, while guidelines (C) suggest best practices and policies (D) establish organizational rules, but none of these specify the detailed steps required for maintenance.