Data security policies are often confused with information security policies. The latter typically focus on all aspects of information security, including equipment, applications, employees, vendors, ...