As a side note, I think queer people specifically understand informational hygeine far better than the privileged class, due to life experiences where maintaining such hygeine has been requisite for survival.
If your policies aren't written by queers, they are not going to adequately address your infosec needs.