organizational policy
163501·updated Aug 30, 2026A formally documented set of management directives, issued at the enterprise or program level, that establishes the rules, constraints, roles, and responsibilities governing an organization's conduct in a given security or compliance domain. It sits at the top of the policy hierarchy—above issue-specific and system-specific policies—and is technology-agnostic, expressing *what* must be done rather than *how*; lower-level standards, guidelines, and procedures derive their authority from it. In practice, controls frameworks invoke it as the baseline against which individual behaviors, configurations, accounts, or processes are evaluated for conformance, so that a finding of "violation of organizational policy" signals a deviation from these enterprise-level rules rather than from any single technical standard or system setting.
Source
The accounts are in violation of organizational policy, orthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- Organizational Policy - an overview | ScienceDirect Topics
- What is a Security Policy? Definition, Elements, and Examples
- security policy - Glossary | CSRC
- SI-1: Policy and Procedures - CSF Tools
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
This is a compositional phrase, not a term of art with a fixed technical definition. It combines two ordinary words: "organizational" (belonging to or set by an entity such as a company, agency, or institution) and "policy" (a governing rule or directive). An organizational policy details the purpose, ownership, roles, and responsibilities of an institution, and is often the highest-level policy statement from which all other policies, standards, guidelines, or procedures draw their authority. In NIST SP 800-53, the phrase appears in control AC-2(3), listing conditions under which accounts must be disabled — including when they "are in violation of organizational policy" — where it simply means any binding rule or directive the organization has established. The phrase functions as a catch-all reference to whatever governing rules the organization has formally adopted; it does not denote a specific, enumerated construct with its own canonical definition in the standards literature.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- organizational policies
- possessive
- organizational policy's
- pluralpossessive
- organizational policies'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A formally documented set of management directives, issued at the enterprise or program level, that establishes the rules, constraints, roles, and responsibilities governing an organization's conduct in a given security or compliance domain. It sits at the top of the policy hierarchy—above issue-specific and system-specific policies—and is technology-agnostic, expressing *what* must be done rather than *how*; lower-level standards, guidelines, and procedures derive their authority from it. In practice, controls frameworks invoke it as the baseline against which individual behaviors, configurations, accounts, or processes are evaluated for conformance, so that a finding of "violation of organizational policy" signals a deviation from these enterprise-level rules rather than from any single technical standard or system setting.DR-088 backfill from the noun definition column