A "good" security policy includes the following

changing passwords weekly

require passwords be at least $25$ characters long

based on confidentiality, integrity, and availability

detail about each user's roll in the organization

include a reference to the SANS institute to avoid copywrite infringement