IAM Policy, Standards, Guidelines, and Procedures Must Work Together

Now that we've named who needs to be involved, the next question is what they are actually working from.

Teams use the words policy, standards, guidelines, and procedures as if they mean the same thing. They do not. That difference matters a lot more in implementation than most teams realize.

One of the most common gaps is that operational and IT teams are often not aware of the policy or standards that apply to them. They may not use the word guideline at all. What they usually have, if anything, is an SOP or runbook. If those operational documents are disconnected from policy and standards, the work may still get done, but the model underneath it starts to drift.

This matters across identity types and environments. If governance is inconsistent in one part of the model, it rarely stays there.

Start by getting clear on:

What belongs in policy versus standards?

Which identity domains already have standards, and which still depend on tribal knowledge?

Where are guidelines needed because teams are making judgment calls without shared direction?

Which procedures, SOPs, or runbooks reflect how the work is actually done today?

Which of those are disconnected from current policy or standards?

Who owns each layer, and who uses it to make decisions?

For example, in privileged access:

Policy: Privileged access must be approved, time-bound, and monitored.

Standard: Privileged access must use MFA, named accounts, and JIT elevation where supported.

Guideline: Use standing privilege only where operationally necessary and document compensating controls.

Procedure: Submit elevation request, obtain approval, activate access, log activity, and remove access at the end of the approved window.

You do not have to fix every governance document at once. But teams do need a shared foundation they can actually work from.

Why it matters

When these governance layers work together, implementation becomes easier to sustain across systems, identity types, and access paths.

Policy, standards, guidelines, and procedures are not interchangeable. The clearer each layer is, the easier the model is to implement consistently.

Where do you see the most confusion today: policy, standards, guidelines, procedures, or exceptions?