Information security policies are the documented business and technical rules for protecting an organization from information security risks faced by its business and technical infrastructure. These written policy documents provide a high-level description of various controls, which the organization will use to manage its information security risks.
The information security policy documents are also considered to be a formal declaration of the management’s intent to protect its information assets from relevant risks. In specific cases, the policies are supported by information security procedures that identify key activities required to implement relevant information security policies.