A statement of the measures, especially operational, to be taken in order to defend a system against the postulated threats. The policy may specify the security processing mode together with the security model and their relationship with physical and personnel security controls. For example, the security policy will usually specify the way in which passwords will be allocated and the arrangements for audit, etc.