The security policy is the driving force that causes all four of the steps of the security wheel to occur. It is the policy that dictates the need to secure, test, monitor, and improve.