The security policy should be specific enough to define all requirements, but not so inflexible that it does not account for growth within the organization or changes in infrastructure.