A Security Policy is a high-level document that states an organization’s security objectives, its scope, who is responsible for what, and management’s commitment to protecting information assets. Senior leadership approves it, and it becomes the foundation every other security document builds on. A policy says what must happen, deliberately leaving the how to the documents beneath it.
Those lower tiers do the detailed work. Standards set mandatory specifics, procedures give step-by-step instructions, and guidelines offer recommended practice. Keeping the policy general is a feature, not vagueness, because it lets the policy stay stable for years while standards and procedures change with technology and threats. A policy that names a particular product or version dates itself fast and gets reopened for board approval far too often. Policies also need a review cycle, because one written years ago and never revisited slowly drifts out of step with how the organization actually operates.
Why does security policy matter for the CISSP exam?
Policy development and the documentation hierarchy sit in Domain 1: Security and Risk Management. Know the difference between regulatory, advisory, and informative policies, and how a policy establishes accountability and the authority for security work.