security policies and plans

Using information from the course materials and the lecture, discuss the difference between a security policy and a security plan. 

Assume you are the information technology director of a small firm and that you are tasked to create a security plan for your organization. Describe the major points you would include in your plan, and discuss why they are important to your plan. Your initial response should be a minimum of 500 words in length.