Adopting policies is the starting point. Their application and storage now take effect. New policies should lead to the creation of new processes and procedures.