Definition
A Security Policy defines objectives, principles and requirements for protecting organisational information and Assets.
Human Explanation
It sets direction and the basic duties of employees and management.
Why it Matters
It provides a reference for procedures, standards and security decisions.
Conceptual Boundary
It does not describe detailed execution. It states principles, while procedures and standards provide detail.
Practical Perspective
A good Policy should be understandable to every employee, not only IT specialists.