Policy

A clearly-scoped set of rules based on an organization’s Risk Appetite.

Source: Gemara

Industry Cross-Reference

A policy is a set of statements, rules, or assertions, formulated and enforced by the governing body of an organization, to direct and limit its actions in pursuit of long-term goals and specify expected behaviors.

Source: NIST CSRC Glossary - Policy