A policy is operational only when people know who approves a tool, who evaluates risk and what happens when a rule is ignored. Every material requirement needs an accountable role, an accessible workflow and records created as the work happens.
What leadership should ask now
What is already happening? Who has authority to decide—and who is accountable for the outcome? What information and people are affected? What approval, documentation and monitoring would make the practice defensible?