The reason why you must have an information security police...

ensure that everyone knows who is responsible for backup procedures.

ensure that staff do not break any laws of the organization

define who is responsible to provide any resources for security implementation.

give direction to set up information security in the organization.

give overall responsibility to the steering committee