Glossary: Security Controls and Change Management

Policy

Also written: security policy, policies

A document that states what must happen and why, such as "staff laptops must receive security updates within 14 days". An SOP gives the steps for how.