A mandatory requirement, code of practice or specification approved by a recognized external standards organization.

A mandatory requirement, code of practice or specification approved by a recognized external standards organization.

• A. Policy
• B. Threat
• C. Procedure
• D. Standard

Answer: (D)

Standards are formal, mandatory requirements or specifications that are approved by a recognized external standards organization. They provide a baseline that organizations implement to ensure consistency, security, and interoperability across systems and processes. A policy, by contrast, is an internal directive expressing management intent and high-level requirements; it isn’t necessarily created or approved by an external body. A procedure translates those policies into concrete steps to be followed, focusing on how to implement the policy. A threat is a potential harmful event considered in risk assessment, not a normative document.

The description matches a standard because it emphasizes a mandatory requirement or specification that has external approval. Examples like ISO/IEC 27001 or PCI DSS illustrate standards used to meet recognized external expectations.