Dang near forgot about this. Also, the usual blessings from important people who have a lot at stake. If the general feeling is a positive one, I'll post The Gory Commercial Details. Policies are my forte, so here goes. Policies should always be the starting point.
Policies are a statement of the organization is trying to achieve.
More to the point, it is comprehensive. Too may sites I've been into bog down and exhast themselves in detail. They seem to think they've put all the effort they need to in, and stop. Recently, a large brewery here in Toronto had a security problem. So much for dial-in passwords and Novell style security.