Create a comprehensive security policy document tailored to your organization.
Example only, not legal advice. Have a qualified lawyer check it suits your circumstances and meets your local laws (including signing and witnessing rules) before using it.