In their second interview together, Steven Furnell talks to Kevin Fitzgerald about information security policies, drawing upon his practitioner experience in Australia. The discussion considers the role and coverage of policies, and the degree of attention that they may (or may not) receive within organisations. [Released under Creative Commons Attribution-NonCommercial-ShareAlike 2.0 UK: England & Wales licence.]