Building and managing a security program is an effort that most organizations grow into overtime. I have worked with startups who had no rules for how assets or networks were used by employees.

Data Classification Policy This document defines the university's system and data classification scheme and established procedures for protecting critical IT systems and sensitive university data ...