A strong data security policy should be specific enough to address the unique situation of the enterprise, but general enough to provide coverage on all aspects of the business. Save the long documents for security procedures and standards; with policy, short and to the point is best. Employees will remember a policy that is clear, simple and firm.