The difference of Security Policy and Acceptable Use Policy ?

Acceptable Use Policy (AUP) is a set of constraints and practices that users must agree and sign off to access the corporate network, endpoints, applications, and the Internet.

Information Security Policy is a statement of how the organization plans to protect the company's physical and information technology (IT) assets.

So is AUP part of the infosec policy?