Which statement best describes the difference between best-practice and compliance?

Which statement best describes the difference between best-practice and compliance?

• A. Best-practice may exceed what is sufficient to meet compliance
• B. Best-practice is the same as compliance
• C. Best-practice is always stricter than compliance
• D. There is no difference

Answer: (A)

The main idea here is that compliance sets the minimum you must meet, while best-practice goes beyond to reduce risk more than those minimum requirements. In PCI DSS terms, being compliant means you implement the controls defined by the standard to pass the assessment. But security professionals often adopt best-practice measures that exceed those minimums, such as adding extra layers of defense, more frequent monitoring, or stricter configurations, to further lower the chance of a breach. So the statement that best-practice may exceed what is sufficient to meet compliance is the best description. For example, PCI DSS might require certain access controls, but best-practice could push you to enforce multi-factor authentication everywhere, implement continuous monitoring, or apply more aggressive patch management. Those extra steps go beyond the bare minimum, which is why best-practice isn’t simply the same as compliance and isn’t always strictly “more strict” in every single case.

The main idea here is that compliance sets the minimum you must meet, while best-practice goes beyond to reduce risk more than those minimum requirements. In PCI DSS terms, being compliant means you implement the controls defined by the standard to pass the assessment. But security professionals often adopt best-practice measures that exceed those minimums, such as adding extra layers of defense, more frequent monitoring, or stricter configurations, to further lower the chance of a breach. So the statement that best-practice may exceed what is sufficient to meet compliance is the best description.

For example, PCI DSS might require certain access controls, but best-practice could push you to enforce multi-factor authentication everywhere, implement continuous monitoring, or apply more aggressive patch management. Those extra steps go beyond the bare minimum, which is why best-practice isn’t simply the same as compliance and isn’t always strictly “more strict” in every single case.