The correct hierarchy for implementing a security policy starts with the Laws, which are the highest level of legal requirements that an organization must follow. Next are the Regulations, which are specific rules that are derived from laws and apply to certain sectors or types of data. Following regulations, we have Policies, which are high-level statements of management intent and direction for security within the organization. Standards come next; they are specific mandatory controls, rules, and configurations that implement the policies. Finally, Procedures are detailed step-by-step instructions that ensure consistent and repeatable compliance with the standards.
References: This hierarchy is supported by various sources, including industry best practices and guidelines on information security policy implementation. The hierarchy aligns with the principles outlined in resources such as the LinkedIn article on Information Security Policy Hierarchy1 and the Gartner community post which states "Policy sets goals, Standards define rules. Controls implement standards, procedures detail steps. Secure baseline config ensures compliance."2.