Added toc to security policy