Cyber security policies and procedures drafting