GRC

Policy, standard & procedure

A policy states the rule and why it exists; a standard sets the specific, measurable requirement; a procedure spells out the exact steps to follow.