https://www.sans.org/reading-room/whitepapers/policyissues
https://www.sans.org/reading-room/whitepapers/policyissues/approach-enterprise-security-architecture-504