To create a custom policy, the security team can either add a new policy from scratch or clone an existing policy and modify it to meet their needs. Adding a new policy allows for complete customization, while cloning an existing policy speeds up the process by providing a template that can be adjusted. Disabling an out-of-the-box policy or simply editing the query in an out-of-the-box policy does not create a new custom policy but rather modifies existing ones.