Security Policies and Procedures are, and should be, the product of a thorough security assessment. Security is a situational discipline, which means that each security program must be need-driven. There may be some universality to some security program, but universality applies to goals and objectives. The means for achieving the stated security goals and objectives must be situationally determined.