Page 221 - CyberSecurityEssentialsEnglish

TABLE 5-9: THE DIFFERENCE BETWEEN FOUR KINDS OF DOCUMENT

Document Core content The central question

Scope, principles, general
Policy responsibilities, prohibitions and What is the rule, and why?

exceptions.

Procedure Steps, roles, inputs, forms, records. How do we carry out the rule?

Frequently asked A clear question, a short answer, and a What is the direct answer to a
questions reference. recurring question?

Description, eligibility, requirements,
Service guide How do I obtain the service?
channels, timing, escalation.

◇ Case study: one source, several derived products
This composite teaching case is provided for explanation and does not describe a specific

event.
Background: the instructions for a service were spread across a circular, a web page, and
internal messages. Problem: answers differed and requests were handled late.
Decision: create a single authoritative source, then derive a service guide, frequently
asked questions, and a form from it.
Result: changes now begin at the source and flow to the dependent materials.

Lesson: do not let AI unify the texts before the organization has settled the contradiction
in the rules themselves.

⚠ Warning: mark the gaps rather than filling them
When drafting a policy or a procedure, ask the tool to place an explicit marker such as

“decision required” or “source not identified” instead of filling the gap with an
assumption that sounds reasonable. Fluent language can conceal a rule that nobody ever
approved.

● Remember: Section summary

• Key idea: The four document types serve different purposes and should not be merged
into one text.
• Practical decision: Keep one authoritative source and derive the other documents from
it, so that a change begins in one place.
• Mistake to avoid: Letting a tool fill a gap with a reasonable-sounding assumption
instead of marking that a decision is required.

220