4. Write an issue-specific security policy for an organization. The issue the policy will address should be realistic and match what the organization is likely to be facing. The policy should be comprehensive and leave little room for interpretation. That means being explicit in what the policy does and does not do, who the policy is intended for, what are the consequences of the policy, among several other aspects. Because the policy is addressing a specific issue, it should provide a detailed description of what the issue is, when the issue is occurring, who is responsible for the issue, who is the cause of the issue, why is the issue happening, how the policy addresses the issue, etc. Again, the policy should be detailed and comprehensive.