Question

"the general hierarchy to be followed when determining security protocols is:"

Answer 1

I believe the answer is: Legislation/regulations, standards, guidelines

Because of the hierarchy, the punishment for each strata of violation is also different. Volating legislation in security protocol can resulted in jailtime, violating standard tend to be resulted in fine since it tend to only related to ethic, while violating guidelines tend to be resulted in inefficiency.