Importance of Corporate Security Policies and Standards

Information security policies underpin the security and well being of information resources. They are the foundation, the bottom line, of information security within an organization.
Information Security Policy World

People frequently use the terms "policy," "standard," and "guidelines" to refer to documents that establish the security stance of an organization. For the purposes of this handbook, the following definitions will apply:

A Security Policy is a concise statement, by senior management, of the corporate commitment to take responsibility for protecting information. The policy is then implemented by taking specific actions, utilizing the specific security standards, procedures and mechanisms that are most effective.
SANS Institute, website

A CORPORATE SECURITY POLICY is a document that outlines specific requirements or rules that must be met within the organization. In the information security realm, policies are usually goal-specific, and usually cover more than one platform or area. An example of a policy is "Users must be authorized to access the system by using at least a userid and password. Users who will have access to restricted applications must use an additional form of authentication such as a secure token or a biometric identification."

A STANDARD is a collection of system-specific and procedure-specific requirements that must be met by everyone. For example, an HP NonStop server policy would cover the security rules and regulations that harden the NonStop server. People must follow this standard exactly if they wish to add new servers or...