Policies state management intent and define security outcomes. Standards, guidelines, procedures, and baselines from the operational framework for achieving those outcomes. In this article, we define these security framework elements and their relationship to policies. (This article is updated content from the book, "Just Enough Security.")