All security mitigations should have policies directing their application and use. All SAT programs should begin with or be driven by an SAT policy document. Part I of this paper covers the various components which should be covered by any SAT policy and part II gives a generic SAT policy example, which can be used as the basis of your organization’s SAT policy, if desired. You can use this paper to craft your organization’s first SAT policy document or use it to update or modify your existing document.