SANS has some great information on generating security policies, and a few examples.