Three types of security policies in common use are program policies, issue-specific policies, and system-specific policies. Program policies are the highest-level and generally set the tone of the entire information security program. Issue-specific policies deal with a specific issues like email privacy.