A security policy should secure the company from all sides and take into account all its assets. It should cover all software, hardware devices, physical parameters, human resources, information / data, access control in its scope.