A good security policy should include the following:
Identification of your business goals and objectives
Establishment of a risk assessment process to identify potential threats and vulnerabilities
Development and implementation of a secure information system that is protected from outside attacks