[WM] add first draft of IT security policy doc