Answer:
True
Explanation:
Policies should ideally be based on principles, while at the same time addressing as many specific situations as possible.
A security policy cannot refer to every possible event that might affect the security inside a company, a city, or even a country, but it should lay out the conceptual basis from which enforcers can reach conclusion in case the have to face an unspecified situation.
