There are many elements when involving a security policy to ensure compliance with local, state, and federal laws and regulations. The three I believe should be implemented are management and risk assessment teams. This will help handle any problems from people or nature towards the business. Collect data within the company making sure we aren't breaking any rules or regulations while also keeping a safe environment not only for the employees but the customers as well. Training departments which would train and help with understanding how to handle different situations. They will handle any updates that need to be explained to the company and help train new employees while also taking new input from the rookies because everyone knows a pair of fresh eyes always catches things old ones can't. Lastly a security incident report team to handle the issues within the company. There will be a layout of step by step exactly what to do and who to contact in certain situations. Also include a logbook of who was there at the time and any additional information (like evidence)