Security policy is a definition of what it means to be secure for a system, organization or other entity. For an organization, it addresses the constraints on behaviour of its members as well as constraints imposed on adversaries by mechanisms such as doors, locks, keys and walls. For systems, the security policy addresses constraints on functions and flow among them, constraints on access by external systems and adversaries including programs and access to data by people. A guideline is a statement by which to determine a course of action. A guideline aims to streamline particular processes according to a set routine or sound practice. By definition, following a guideline is never mandatory. Guidelines are not binding and are not enforced. Any organisation with substantial IT system coverage will have a number of policies in place that specify the actions required to deal with problems, in routine or non-routine circumstances that occur. Disaster recovery policies A disaster recovery plan is a document that defines the policies and procedures for dealing with various types of disasters that can affect an organization, especially the organization's IT (Information Technology) infrastructure. This is a statement or plan of what to do if things go wrong through acts of theft, destruction (by natural causes such as fire, flood, earthquake etc. or by vandalism) or loss of data, which severely impacts on the business function (or security) of an organisation. Updating of security procedures Security features must evolve with the IT technology used in an organisation. Security procedures should be reviewed and updated regularly (usually by an organisation’s head of IT security or IT services, sometimes in conjunction with outside