The policy should also identify individuals managing the partner'ssecurity program, adds Harry DeMaio, a director in Deloitte & Touche'senterprise risk practice in New York City.