Policy

A policy states what should happen. It does not make anything happen.

That gap is where most compliance programmes live. A policy saying all systems must be patched within thirty days does not patch anything, and if nothing measures or enforces it, the policy is a description of an aspiration. Policies are necessary as a statement of intent and they are the weakest possible control on their own.