A security policy proves that the organisation has documented how a control or security process is intended to operate. It may show ownership, responsibilities and expected behaviour. The document does not by itself prove that the control is currently operating effectively or applied consistently across every relevant environment.
FAQ