When creating a security policy it is good to look to those who have come before you. Much of the work has already been done by others. There are many good examples available on the internet for use as a template for your organization. There are a few items which should be addressed in all policies. These are the important items which need to be addressed in all policies. I put these items into a template so any other policies created contain the same important information. 1. Define the specific issue being addresses in the policy 2. Define the organizations position on this issue 3. Define how this policy applies to the environment, with examples 4. Define course of action for violation of this policy 5. Define roles and responsibilities of personnel 6. Define level of compliance required 7. Define how compliance will be measured and audited to assure compliance There are two great whitepapers available from SUN which describe policy creation guidelines and provide you with a template. They are available here and here.