Such a procedure could be the request to access a specific set of sensitive data, where the approval path (system owner, application owners, and so on) and conditions (Virtual Private Network (VPN), strong authentication, and so on) are explained in detail.Practical example Here is an example of how a policy is defined and implemented with procedures and practices.