sentence1: The organizations viewed information security policies as the foundation of their information security programs and the basis for adopting specific procedures and technical controls.
sentence2: Adopting specific procedures is the single most important part of their strategy.