A procedure differs from a policy in that it:

A high-level statement regarding the company's position on a topic describes a policy, not a procedure - policies set the organizational intent and direction without specifying how tasks are carried out.

Setting a minimum expected baseline of behavior describes a standard, which defines the specific mandatory requirements that support a policy rather than providing step-by-step operational guidance.

A procedure is defined as a detailed, step-by-step document that instructs personnel exactly how to perform a specific task or process, such as how to respond to a security incident or how to onboard a new user. Unlike policies, procedures are tactical and operational in nature, translating high-level policy requirements into actionable instructions. This distinction is fundamental to security governance frameworks and separates procedures from policies, standards, and guidelines.

Describing adverse actions when violations occur relates to enforcement mechanisms or disciplinary procedures within a policy framework, not the operational definition of a procedure.