# SCPs

* Remember that **Organizations does not replace associating IAM policies** with users, groups, and roles within an AWS account, so you **still need to set up appropriate IAM policies for your root and member accounts**.<br>
* When you apply an SCP to an OU or an individual AWS account, you **choose to either enable (whitelist), or disable (blacklist) the specified AWS service**.
