If you look at a doc from just a few years ago, odds are you’ll find a number of aspects that are outdated in your current business environment. Old security policies that don’t take into account new threats and industry best practices can be actively harmful to your organization.
To that end, it’s essential to keep your Security Policy document updated. Ideally, your doc will be easily extensible so you can modify it when organizational conditions or the security environment change.