List and explain several types of policies that can be used to govern information security.  Please give specific examples.