Implementing Security Policy

I have been asked by my company to implement security measures. I was given no information from upper management on what type of security, levels of security, etc. We have absolutely no written policies on security. I explained that this was verybroad, and would require alot of time to complete. However, they gave me a very short period of time to complete this. Does anyone have any thoughts or suggestions on how to approach this?