Documenting Security Policies and Procedures

We've just started formally documenting our iSeries security policies and procedures in order to become compliant with some security standards and regulations. Management wants to include policies AND detailed step-by-step procedures in the same document and I maintain that it's important to keep the policy separate from the procedures.

Granted, when we're all finished, we could cut and paste all the policy into a separate document so maybe it really doesn't make a difference.

Your comments will be appreciated.

Thanks,

Bryan Burns
iSeries Specialist