How to Create an Effective Cybersecurity Policy