In short 'Yes'.
For example, PCI-DSS defines a security policy as "Set of laws, rules, and practices that regulate how an organization manages, protects, and distributes sensitive information" and as such includes all (sub) security policies that may be specific to different technologies, practices and the AUP.
There is some disagreement over the term Security Policy with some organisations using this specific term to refer to a short (usually less than one page) statement about the organisation's stance on, and approach to, security i.e. a kind of security mission statement.
For most organisations however, an AUP is a key part of the Security Policy as a whole, as is the 'encryption of data at rest and in transit' policy, and the 'firewall change management policy' and the 'network and services audit and testing policy' etc. etc.