Proper protection of data assembled and recorded in an organization is a core factor for the prosperity and safety of the organization. With the introduction of the Internet in business environment, the technicality of accessing as well as disseminating information has been made easy but generated more challenges at the same time especially with the rise in the number cyber criminals. This aspect makes the current business environment extremely flimsy. The best way to manage and prevent such incidents is to formulate effective data security strategies. Protected communication helps both the organization and its clients to gain from the resources provided by the Internet. This understanding underscores the importance of having proper cyber security in an organization. This paper will discuss the procedures of establishing relevant Internet security policies by identifying and describing the procedures, as well as recommending possible solutions to the challenges that arise in the process. What is a Cyber Security Policy? To define what cyber security policy it is necessary to explain what the term security policy implies. Security policy is a strategy that lists the most vital assets of an organization and guidelines on how they are to be safeguarded. The main reason for formulating the document is to inform the employees with a transitory summary of the standard rules of how to handle information assets, illegal, and legal practices, hence involving them in protecting the sensitive documents of the organization. It is mandatory for any staff member, who intends to access resources that have been classified as vulnerable targets, to refer to the security policies before using the resources (Shoemaker & Conklin, 2011). A decent security policy should incorporate a number of elements. It must elaborate how confidential documents should be handled and stipulate techniques of maintaining a strong password. Furthermore, it should inform the staff on the steps they should adhere to in case an incursion transpires (Shoemaker & Conklin, 2011). It should also ensure that the Internet connectivity is protected as the company e-mail system. The major purpose for establishing security guidelines is to set an organization’s data security standard and describe the role of employees in safeguarding the documents of the firm, as well as the significance of a protected communication when using the Internet for transacting business. Therefore, cyber security policies mainly focus on the protection policies that safeguard the organization from malicious attackers via the Internet (Shoemaker & Conklin, 2011). Procedure for Creating Cyber Security Policy Risk Assessment The initial step for creating a security policy demands for the assessment of the organization’s network and all the vital resources, so that suitable actions can be executed well. The process begins with disclosing the organization’s sensitive data resources. This initial stage is referred to as risk assessment. Risk assessment is the practice of revealing the vital records of the organization as well the role they play. In this stage, the company identifies the information they intend to conceal and individuals to whom this data will be hidden from coupled with the technique the c