Cloud computing is becoming increasingly important for provision of critical services because of potential cost saving, scalability and elasticity. Therefore, it is particularly important for clouds and cloud-based services to be resilient, i.e., they are able to operate correctly and continuously even in the presence of challenges. To do this, a number of resilience supporting mechanisms are needed at various levels in cloud infrastructure. It is non-trivial to manage these mechanisms and there is a need for flexible instruments which assist cloud providers in this complex task. Policy based management is an established instrument to manage resilience supporting mechanisms and they are useful if it allows not only high level description of abstract policy (e.g high level security and resilience requirements), but also enables such policy to be refined and eventually mapped into an appropriate low levels in cloud settings. This paper sheds light on basic concepts behind policy based management in cloud, more specifically it emphasises the use of policy refinement which is the process of translating higher level requirements (such as security and resilience requirements) into the sequence of actions at lower levels that can implement them, in order to generate more refined policies that govern the behaviour of an overall cloud system when under challenge. We finally present two example scenarios on how policy refinement can work for the cloud to establish its relevance for the overall resilience management.