Security Policy Questions

I am a new security officer at a company that formally had a CISO, who is no longer there. I am now responsible for maintaining 4-15 different policies for this SaaS company

My question is more on the compliance end. I have a “Corporate Security Policy” and a “SaaS Hosting Security Policy” which I can only assume is given out to Customer for due diligence. Is this a normal way to break down Policies. Are corporate security policies usually confidential …

ciso compliance confidential corporate corporate security customer customers cybersecurity doing down due diligence end hosting isn officer policies policy question questions responsible saas security security officer security policies security policy things