Technology alone does not keep an organisation safe. People need to know what to do — and that is what policies are for.
What is it?
A security policy is a written rule that sets out how people should protect information and systems. Best practices are the widely agreed, proven habits those policies are built from.
Select any component in the diagram to read what it does.
Text description of this diagram
Policies are simple written rules that tell everyone how to work safely.
Why is it important?
Without clear rules, everyone guesses, and security becomes inconsistent. Policies make good behaviour the default: they tell people what a strong password looks like, who may access what, and what to do when something goes wrong. They also make expectations fair and enforceable.
How does it work?
Common policies you will meet include:
- Password policy — how long and complex passwords must be.
- Acceptable use policy — what you may and may not do with company devices.
- Access control policy — who may access which systems.
- Incident response policy — the steps to take when an attack happens.
- Backup policy — what is backed up, how often, and where.
A real-world example
A company’s incident response policy says: “If you suspect a phishing email, do not delete it — report it to IT immediately.” Because the rule is written and trained, an employee who spots a suspicious message knows exactly what to do, and the security team catches the campaign early.
Check what you learned
What is a security policy?
A written rule that sets out how people should protect information and systems.
Why are written policies better than leaving security to individual judgement?
They make good behaviour consistent, fair, and enforceable, instead of everyone guessing.
Key takeaways
- Policies are the written rules that guide secure behaviour.
- Best practices are the proven habits policies are built from.
- Clear rules make security consistent across everyone.