A security policy is a document that outlines rules for computer network access, determines how policies are enforced and lays out some of the basic architecture of the company security environment. In the information / network security realm, policies are usually point-specific, covering a single area. For example, an "Acceptable Use" policy would cover the rules and regulations for appropriate use of the computing facilities.

Security Policies are necessary to set standards for appropriate behavior within an organization, and to provide a foundation for HR or even legal action in response to inappropriate behavior.