What Five Policies Does Every Organization Need?

I'll go for Storage, Email Use, Hardware/Software assignment and fair use.

Those are the ones that come to my mind, but of course there are plenty more.

1.Computer/Network access policy.
2.E-mail communication.
3.Internet Access.
4.Removable media control.
5.Computer device/asset management.

I am not sure where this would fit but I have a client who has real problem with this. He is certain he is losing a lot of productivity to this.

The 5 *policies* I believe are the foundation to building a solid IT capability for the business includes:

1) Information Management - information is an asset of the company and needs to be given its proper place as a policy (simply put ? make people know you recognize information is probably the most important asset of the company)

2) Information Security - What security means to "us" and high-level how we protect it (you are not allowed to send our customer list to a competitor and no they can have access to our systems)

3) Systems Development and Maintenance - Why and framework for buying/building systems and our expected level of quality (again on the asset front, what be buy/build are assets of the company and we need to manage them as such, including their quality).

4) Use of company-owned technology resources (assets and services) - this would include email/internet use as well as devices such as PDAs, laptops (no kids please), and telephone for example.

5) Use of employee-owned technology - this would take a position that the use of personal hardware/software is prohibited (hey, your cookbook software is crashing the network).

I highlight the term policies as they must be very succinct - down to the point - no fluffiness. Also, not to confuse policies (the what we believe) with procedures (the how we carry it out).

In no particular order of importance:

Internet policy: governing which sites are or are not acceptable according to company guidelines. Non work-related internet surfing time is limited to lunch, breaks and 30 minutes a day beyond that... and yes it is actively monitored. :)

Instant messaging policy -- not allowed at all

E-mail policy: business e-mail only; personal e-mail is forbidden at work due to the security risk and the threat posed by outside attachments.

Software policy: who installs what and when. Our desktops are locked down for the most part, but occasionally we open local priveleges for people whose job function or software requires it.

Hardware policy: if work buys it for you, it is supported fully; that cool Christmas tech gadget is not supported and positively not allowed on the network, period.

These are in no particular order:
Responsible Use
Passwords
VPN
Tape BackUp Retention
Computing Hardware Standardization

One of the most important policies to have that has not been mentioned is a disaster recovery policy.

There are many,but IMHO the top ones are;

Problem management
(recognize, report, repair, review)

Change management
(review, prior notification to those effected, implementation and final review)

Security management
(Site security, backup and disaster recovery)

Performance management
(measure and improve, review)

Process management
(run books, education and review)

My top 5 are:
1). E-mail policy including the organization's right to monitor or inspect e-mails to limit liability.
2). Personal use of Company computer - including internet access use and company inspection of (their) hard drives.
3). Document Retention policy - including e-mail and document retention. Can we say Microsoft lawsuit as an example ?
4). Pornography policy - Kiddie porn has no place on my servers. Enough said.
5). Ownership of Software and Data ownership policy - could be rolled into the corporate policy on intellectual property rights. You might not like them, but it is a fact of life in any large organization that you sign away your patent rights.

I don't know that I could get this up to 5 policies.
I feel that it should be be tailored to the organization, for example my organization is quite liberal (and needs to be because of our type of work - personal healthcare)
My policies in place are designed more toward lessing the impact of liberal use rather than controlling it. (ie Internet Radio sucks up bandwidth, don't use it)
We have a (very liberal) Acceptable Use Policy which blanket covers use of the hardware, software and internet/email access.
(in a nutshell - our hardware, our software, our internet, we pay for it, we own it, we let you use it, don't abuse it, don't lose it)
We have a Security policy (designed around HIPAA) that spells out acceptable use of company generated information.

The flip side here is that I have more policies that are in IT only, not necessarily part of the "organization". We are a relativley small shop (less than 100 users and computers)so my IT group is pretty small and intimate. Many policies are verbal, not written. Back Up/Recovery, Maintenance/Repair, and Security.