Information security policies discussion

When do you think an organization needs information systems security policies? Why? Explain
Where do information security policies fit within an organization?
Why is enforcing and winning acceptance of information security policies difficult?