Building Policy

Here's a SANS paper which discusses the corporate requirements for security and how to get there. I did a quick skim of the paper and it appears that they only thing missing is FIPS 199 compliance (a common syntax standard).