# Chapter 3: Policies

SANS offers a template library: https://www.sans.org/security-resources/policies

# Standards and Procedures
Standards and procedures bring policies to life. Policies describe “what” we are trying to achieve, standards and procedures form the “how.”

Example: a policy states that access be authenticated by use of a password. 

A **Standard** provides more detail as to what constitutes a password, like complexity requirements, the process for changing a password, storage requirements, ability to reuse passwords or otherwise, etc.

**Procedures** describe specific steps in order to achieve those standards at a technology level.