Learn in the textbookSecurity Policy and Management Activities
DefinitionAn information security policy (情報セキュリティポリシー) is a set of documents that brings together an organization's approach to protecting its information assets and the rules it must follow.
ExplanationIt is usually built in three layers: the basic policy (the information security basic policy) at the top, the control standards that turn it into concrete rules, and the implementation procedures that describe how work is done on the ground. Higher documents are more abstract, and each lower document is based on the one above it. Some definitions count only the basic policy and the control standards as the policy and leave the procedures out.
AnalogyIt resembles a country's legal system: the basic policy plays the role of the constitution, the control standards act as the laws beneath it, and the implementation procedures are the detailed regulations below those.