The person assigned to draft information security policies needs to understand that the policies should be written in a style free of technical jargon and readily understood by the nontechnical employee. It's also important that the document make clear why each policy is important; otherwise employees may disregard some policies as a waste of time. The policy writer should create a document that presents the policies, and a separate document for procedures, because policies will probably change much less frequently than the specific procedures used to implement them.