Rapid Battle Cards 29–42
29 — Policy vs Standard
Policy: high-level desired behavior/course of action.
Standard: detailed measurable rule.
Deciding clue: intent vs specification.
30 — Enterprise Security Policy vs Data Security Policy
Enterprise Security: broad employee/facility/asset/security direction.
Data Security: content-granular data/application sensitivity and protection rules.
Deciding clue: broad enterprise security vs protection of data content.
31 — IT Security Policy vs Data Security Policy
IT Security: directory/password/identity/infrastructure framework.
Data Security: data classification, role/content controls, sensitive information handling.
Deciding clue: technology/security framework vs data-specific protection.
32 — Role Assignment Grid vs Role Assignment Hierarchy
Grid: start from data/classification and map role access.
Hierarchy: start from users/workgroups and inherit/restrict privileges.
Deciding clue: data first vs people first.
33 — CRUD/CRUDE vs RACI
CRUD/CRUDE: data-operation permissions.
RACI: responsibility/accountability relationship.
Deciding clue: what can be done to data vs who owns/participates in a process.
34 — Data Steward vs Information Security
Data Steward: classify/categorize data; clarify business meaning/legitimate use.
Information Security: technical enforcement/operations.
Deciding clue: business sensitivity definition vs security implementation.
35 — Metadata Tracking vs Metadata Sanitization
Tracking: retain sensitivity/classification/location/movement knowledge.
Sanitization: remove hidden Metadata before sharing.
Deciding clue: know/protect metadata vs strip residual information.
36 — Immediate vs Periodic Patching
Immediate: reduce known vulnerability exposure quickly.
Periodic: leaves the known weakness open until later cycle.
Deciding clue: open exploitable vulnerability now.
37 — Security Requirements in Analysis vs Security Retrofit
Analysis: design protection into project early.
Retrofit: costly late rework after build/release.
Deciding clue: identify before architecture vs repair afterward.
38 — Outsourced Control vs Outsourced Accountability
Control: vendor may operate/implement it.
Accountability: organization remains liable/answerable.
Deciding clue: who performs vs who remains responsible for obligation.
39 — Cloud Shared Responsibility vs Unclear Responsibility
Shared responsibility: explicit custody/access/firewall/ownership split.
Unclear: gaps where neither party knows who owns the control.
Deciding clue: explicit assignment vs ambiguity.
40 — Audit Trail vs Policy Statement
Audit trail: evidence of who did what/when and approvals/operation.
Policy: intent without proof of execution.
Deciding clue: evidence vs expectation.
41 — Actionable vs Vanity Metric
Actionable: baselined, interpretable, drives a decision/improvement.
Vanity: counts activity without target/action.
Deciding clue: changes management action vs merely fills dashboard.
42 — Confidential-Data Proliferation vs Single Protected Repository
Proliferation: more copies = more exposure points to protect.
Controlled concentration: fewer explicit protected locations.
Deciding clue: copy count/location spread is itself a risk dimension.