a set of rules and practices that specify how a system or organization provides security services to protect sensitive and critical system resources.
a high-level document describing the principles, approach, and major objectives of the organization regarding security.
the document that details exactly how your organization and its data are secured.