David F. Ferraiolo, Jeffrey M. Voas, George Hurlburt
This paper discusses system security policies. System policies are the set of rules that when implemented afford a strategy for the protection of information. The policy objectives are diverse and span the social-economic spectrum. System policies govern such elements as individual privacy, selective access to proprietary information, national security protection, fraud prevention, data surety and conflict-of-interest. Policy can derive from laws and regulation, but may also stem from business culture and it's tolerance for risk.