How to write your company's IT security policy

Davey Winder advises businesses of all sizes on how to create a workable security policy that's not just a piece of paper. If my consultancy conversations usually start with "so, you think your business is secure?", they invariably end with a response of "so, what can we do about it then?". This is where I really confuse them by not immediately talking about solutions and software, but instead about best practices, education and policy.