This page gives background, points to other institutions policies, etc.
Practice varies widely.
Some organizations have a CPS but not policy or vice-versa. U Colorado shows a university trying to do an open PKI right. If we are to issue certificates starting anytime soon, we probably need to find a shortcut. The University of Colorado and Columbia have adopted shortcut approaches, which offer some clues. The Internet Council, with comments accepted thru Dec 31, 1998.