Whatever form, information should always be protected to its value. A statement of the goals, responsibilities, and accepted behaviors required to maintain a secure environment. Security policies set the direction, give broad guidance and demonstrate senior management support for security-related facilities and actions across the organization. A set of tasks, responsibilities, or guidelines that provide metrics to policies. Procedures are usually very specific in nature, applying to group or individual systems.
Procedures are directive in nature, whereas policies provide principles.
E. Format for policies and procedures 1. Statement of the Organizations Position. For example whether Internet connectivity is allowed and under what conditions. This means clarifying where, how, when, to whom, and to what a particular policy applies. Roles and responsibilities.