Assume you are the president of a small company with $12$ employees. A third party provides IT and security services as needed. You do not have a formal IT security policy framework in place. Which two policies listed here do you think would be most important to create and enact first? Why?