The information security policy is a crucial document for keeping data safe. International standards can help guide what should be included in this policy, but they may not cover everything needed. These standards mainly focus on how to implement the policy, rather than what it should contain. It's important for the policy to match the organization's culture, so it needs to be developed with this in mind.