A security policy is a written set of rules stating what a site protects, who may approve access, how credentials and footage are handled and what happens after an incident. It gives a security system its purpose: hardware enforces a decision, and the policy is where that decision is defined and reviewed.
Equipment without a policy produces footage and logs that nobody has agreed how to use. The policy is the part that connects hardware to how an organization actually behaves.
What a usable policy covers
Purpose and scope, the roles that can grant access, credential and key handling, camera placement and privacy notice, retention and export rules, and the response to an incident. A short document that staff have read beats a long one that sits in a folder.
Policy and the equipment
Every technical control should trace back to a sentence in the policy: a schedule exists because hours are defined, an audit log exists because review is required. Review the policy when the building, the staff or the system changes, and test that practice still matches the document.