Anyone wanting the key elements of an information security policy need look no further than the Information Commissioner's website for a neat Guidance Note on the Security of Personal Information. The measures outlined apply equally to other business sensitive information as well as to personal information and it is only an outline so that it can be filled out with your own policies and procedures.

Even if you don't want a full-on security policy, it is useful to check through the lists to make sure you have covered the basics.

You can find it here:

Regards Mandy Webster

DPC Services for data protection audit

Data Protection Audit Document for practical application