Policies are the heart of a security program. They are management's statement of support and expected outcomes from security controls. In this article, we examine the various components of a policy. (This article is updated content from the book, "Just Enough Security.")