Draw up a formal cyber security policy