An RFC was posted to the Internet a few years ago, and it should be consulted as well. These lead to a baseline security policy, but it may not be realistic in many senses. The baseline policy must be evaluated for feasibility. It may not be possible at any cost to provide the desired level of security, or the available mechanisms may not be reasonable. Generally, one can prevent leakage of information, but not detect it, while one may not prevent denial of access but may detect it.
Operational costs can be such that the security mechanisms become ineffective.
The efficacy and costs of a proposed mechanism must be balanced against the objectives it is intended to achieve in implementing the security policy. At this point, a more realistic security policy may be obtained. Acceptance must be at all levels, with support from the president and provost all the way down to the individual user. This will require preliminary education concerning the vulnerabilities that exist and the consequences of security violations. Implementation includes not only providing the underlying machinery to permit secure operation on the network, but also educating managers and users, auditing the operations for security violations, reviewing the policy and mechanisms for holes and improvements, etc.