Which statement best differentiates data policies, standards, and procedures?

• A. Policies describe the high-level rules, standards are approved conventions, procedures are step-by-step instructions for compliance.
• B. Procedures are high-level guidelines.
• C. Standards describe day-to-day tasks.
• D. Policies are the same as standards.

Answer: (A)

In data governance, policies, standards, and procedures sit at different levels of guidance. The best statement captures that hierarchy: policies describe the high-level rules and intent, standards specify approved, concrete criteria to meet those rules, and procedures lay out the exact step-by-step instructions for implementing those standards in daily work. For example, a policy might require protecting personal data; a standard would specify encryption requirements, data retention periods, and access controls; a procedure would detail the exact steps to encrypt a file, store keys securely, and audit the process. The other options misassign the nature of procedures, standards, or policies, so they don’t reflect how these components actually operate together.