Information security policy

  What is information security policy and what is its central role in a successful information security program? What are two major types of security policy? What is needed to implement effective policy?