General areas/sub topics:

• Acceptable Use Policy
• Backup Policy
  • Use of cloud native storage like Google Drive, OneDrive, etc.
  • Backup of organization data to personal storage (e.g. iCloud)
• Bring Your own Device Policy
  • Encryption
  • OS/Software updates
  • Strong authenticastion to unlock
• Confidential Data Policy
• Data Classification Policy
• Email Policy
• Encryption Policy
  • Developer use of encryption
  • Operational use of encryption
  • Third party encryption
  • Device encryption
• Guest Access Policy
• Incident Response Policy
  • Technical incidents (e.g. break in, ransomware)
  • Financial incidents, e.g. use of stolen cards to purchase services/etc.
• Mobile Device Policy
• Network Access and Authentication Policy
• Network Security Policy
  • Use of network services, e.g. HTTPS/HSTS requirements
• Outsourcing Policy
  • Define outsourcing clearly, e.g. purchasing cloud services that are "controlled" by the user?
• Password Policy
  • use of SSO, 2FA, MFA
  • Use of password managers
• Physical Security
• Policy Remote Access Policy
• Retention Policy
• Third Party Connection Policy
• Use and Purchase of CLoud Services Policy
• User Acceptance Page VPN Policy
• Wireless Access Policy
  • Use of organizational wireless resources
  • Use of public wireless resources (e.g. coffee shops/conference WiFi)