What’s the difference between an IT policy and an IT procedure?

A policy sets out what must happen and why – the rule. A procedure sets out how it happens – the steps. A password policy might say MFA is mandatory for remote access; the procedure explains how to set it up. Organisations that only write policies and skip procedures often find policies get interpreted inconsistently.