Generic Policy Issues to ask
Who is given access to resources?
What is the proper use of resources?
Who needs access to said resources?
What privilege does the system administrator have?
What are the rights and liabilities of the system administrator?
What are the rights and liabilities of the user?
What is done with sensitive information?