A new teller at a regional credit union forwards a spreadsheet of member addresses to a personal email account to finish at home, then leaves the printout on her desk overnight. None of it is malicious, and whether the credit union can do anything about it depends on whether the rules she broke were written down, approved by leadership and acknowledged by her on day one.
Those written rules are policies. On the CompTIA Security+ SY0-801 exam they sit under objective 5.1, which expects you to explain why governance documents matter to a security program. This lesson defines what makes a document a policy, then covers the ten policies the objective names: purpose, contents, enforcement and how each shows up in a scenario.
A policy states what the organization requires and why, with leadership's authority behind it
A security policy is a high-level, mandatory statement of what the organization requires and why. It is approved by senior leadership, applies to everyone within its scope and states the consequences of not following it. It is deliberately general. "Remote access must be encrypted and require multifactor authentication" stays true whether the tool is a VPN today or a zero trust access broker next year. Specific settings and step lists belong in the standards and procedures beneath it, covered in the next lesson.
Most policies share a skeleton: purpose, scope, roles, the policy statements, sanctions, an exception process, and an owner with approval and review dates. A typical header:
Policy: Acceptable Use of Information Systems
Policy ID: ISP-04 Version: 3.2
Owner: Chief Information Security Officer
Approved by: Executive Leadership Team, 2026-03-12
Applies to: Employees, contractors and temporary staff
Next review: 2027-03-12
A policy is a managerial control, and a directive one: it tells people what to do but enforces nothing by itself. Enforcement comes from what surrounds it. Employees acknowledge the policy when hired and yearly after that. Technical controls implement the rule where they can, such as a Group Policy setting, a DLP rule or an MDM compliance check. Monitoring and audits catch violations, and HR applies the sanctions the policy names.
A good policy also has an exception process. A department that can't comply, say with a lab instrument tied to an unsupported operating system, requests an exception, and a named risk owner approves it with compensating controls and an expiry date. Policies are reviewed yearly and after major changes such as an acquisition; PCI DSS, for example, requires the information security policy to be reviewed at least once every 12 months.
The information security policy creates the program, and the access control policy decides who gets in
The information security policy is the top-level document, sometimes called the enterprise or master security policy. It states leadership's commitment to protecting information, sets the program's objectives and scope, assigns responsibilities (the board oversees, the CISO runs the program, data owners classify their data, every employee follows the rules) and lists the issue-specific policies beneath it. The CEO or the board approves it, because it is the source of the security team's authority. Frameworks expect it: ISO/IEC 27001 makes top management responsible for establishing one, and NIST SP 800-53 opens nearly every control family with a policy-and-procedures control, such as AC-1 for access control and IR-1 for incident response. It is enforced through the policies, standards and audits beneath it. A question about which document establishes the security program or defines security responsibilities across the organization is pointing here.
The access control policy states how access to systems and data is granted, reviewed and removed. Typical contents are the principles (least privilege, need to know, separation of duties, deny by default), who approves access (the data or system owner, not IT), MFA for remote and privileged access, a ban on shared accounts, an access review cycle (quarterly for privileged accounts is common) and a deadline for removing access when someone leaves. The identity system, group-based permissions and access reviews enforce it. When an auditor finds 37 active accounts belonging to people who left months ago, the deprovisioning requirement in this policy is what failed. Access control models are covered in the identity and access management section.