Generate policy where none previously existed; this is far more than just simple port-based firewall rule set definitions that many consider to be a security policy. Documentation covers not only security, but also operational and administrative concerns as diverse as physical security, backup/restore policies and change management.