Information security policy

What is information security policy and what is its central role in a successful information security program?
What are two major types of security policy?
What is needed to implement effective policy?