Describes common security principles that should be addressed within security policies. Describes 8 principles and 14 practices that can be used to develop security policies. Significant: dedicated to auditing user activity on a network.