Guidance
High-level guidance on cybersecurity measures from industry groups and standards bodies.
Role
Guidance turns principles into linkable expectations—often adapted from human-readable policy, frameworks or standards. A guideline is still definition, not enforcement: it says what should be true so that controls and policy can implement and assess it.
Examples
Information classification before publication
FOSS contribution guidance requires contributors to classify material before it becomes public, so non-public information is not released through a commit or document. Controls later attach assessment requirements—such as secret scanning and IP review—to that expectation.
Source: Information Classification for Publication (foss-guidance-information-classification) in FOSS Contribution Guidelines.
OSPO programme objective and scope
Guidelines establish that the company supports certain FOSS contribution activities when they benefit the company and do not present unacceptable risk, and they carve out FOSS consumption as out of scope. Policy and inventory controls inherit that boundary.
Source: Programme objective (foss-guidance-program-objective) in FOSS Contribution Guidelines.
AI mitigations upholding AIR principles
In the FINOS AI Governance Framework, mitigations (guidelines) are written to uphold catalogued principles such as Least Exposure and Auditability. The guidance layer is where “filter before the model sees data” becomes an expectation controls can implement.
Source: FINOS AI Governance Framework mitigations, oriented by AIR-PRIN principles such as Least Exposure.
Links upstream
- Principle — guidelines cite the foundational values they uphold, so each expectation stays anchored to why the organisation cares rather than floating as an isolated rule
- Vector — guidelines may name the pathways they are meant to close (for example premature publication or sensitive commits), so readers can see which failure modes the guidance addresses
- Shared lexicon terms
- Human-readable source documents (contribution guidelines, AI frameworks, standards)
Links downstream
Anti-patterns
Unlinkable prose dumps
Pasting a PDF policy into a catalogue without stable guideline ids. Nothing downstream can cite “what was required.”
Guidance that is secretly policy
Organisation-specific mandatory rules, thresholds and exception handling belong in Policy. Guidance should stay reusable across contexts where possible.