There are three types of security policies that can be implemented for an IT system:
Program policies
Issue-specific policies
System-specific policies