The standard has been well received by the industry, and looks set to be adopted internationally. It eventually comes to a point where additional security is simply not cost effective, and other methods, such as insurance to cover loss, should be employed. Security is no longer a simple 'us and them' equation - it really needs to cover everything. Beyond reading the BS 7799 standard, we would also make the following suggestions. Create your policy from the ground upwards.
Users are a good place to start when defining acceptable behaviour.
Think about how passwords should be enforced and for how long they should be valid. Think about how users will be grouped. After you have considered this simple and fundamental step to watertight security, it's time to move on to the next level. You now need to determine what your users will or will not be permitted to do. Look at the servers that you have installed.