HN: Help me formalize computer security practices for companies?

I'm currently drafting a semi-formal document on data security best practices for businesses. It was prompted by concerns at one of my clients, a government-funded research company, but I'm setting it up to be a generic set of recommendations for most businesses. So, if you were concerned about keeping your proprietary information proprietary, while still being able to develop your product, what would you like to see in such a document? If you were an employee, what would you find frustrating, and what would you expect to find in a semi-secretive company? I've divided the recommendations into a series of stages, appropriate for differently-sized businesses, and into two "arenas" -- "internal" security, and "remote" security.