A policy says what; a procedure says how
A policy states what the organization will do; its procedures state how, who, and with what. Keeping them apart makes both usable and keeps neither one stale.
Ideas and field notes
Blog
Practical writing about cybersecurity, compliance, and sustainable security operations.