Create a cyber security policy grounded in your business workflows, with practical rules, clear owners, evidence and a review process.