IT Policy components

I don't think you will find any "standards" for IT Policies.

Any policy is created to address specific issues of operations/conduct that aren't covered by law.

I would like to think that our supervisor has been given guidance on specific areasthat need to be addressed. I would like to think that management didn't just, out of the blue, decide "We need an IT policy."

Some common things you might want to consider includin are: expectations of privacy, acceptable use, non-business use of Internet and email, software piracy, other piracy (downloaded music), telecommuting, security, etc.

I'm sure that anything related to computers and their usage has shown up in a policy someplace. Very rarely will you see a policy that will address EVERYTHING.

Policies should be tailored to a specific environment and a specific set of users. A security policy suitable for a financial institution is probably way too draconian for use by computer users at the local factory. Privacy issues and concerns at the a lwa firm probably wouldn't apply at the local auto dealership. An acceptable use policy at a doctor's office probably is detailed enough to be used by students at the local high school.

Also note: you don't have to put everything in a single policy. You could create a series of policies to address different issues. Policies, once written, are not set in stone. They can be modified to address changing conditions or new issues.

Hope this gets you thinking.