Security policies are broad, high-level statements from top management that establish the organization's security stance. They differ from procedures (detailed instructions) and guidelines (recommended practices). Policies are mandatory and management-driven.