Translate policy direction into decisions for a particular system: what must be protected, who can do what and which operating rules apply. Keep the system's purpose and dependencies visible when defining those rules.
Program and issue-specific policies are broad, high-level policies written to encompass the entire organization, whereas system-specific policies provide information and direction on what actions are permitted on a particular system.
These policies are similar to issue-specific policies in that they relate to specific technologies throughout the organization. However, system-specific policies dictate the appropriate security configurations to the personnel responsible for implementing the required security controls in order to meet the organization’s information security needs.
To develop a cohesive and comprehensive set of security policies, officials may use a management process that derives security rules from security goals. It is helpful to consider a two-level model for system security policy: security objectives and operational security rules. Closely linked and often difficult to distinguish, however, is the implementation of the policy in technology. Similar to issue-specific policies, it is recommended that system-specific policies be reviewed at the organisation's defined intervals and when the system, risks or obligations change.
(Sources: NIST SP 800-12 Rev. 1, NIST SP 800-30 Rev. 1).