In this area, you want to focus on which hardware, application, personnel, or department(s) will be impacted by the security policy. For instance, what type of personal devices are allowed on the network and when? Must the personnel receive formal approval before using such devices on the network? What kind of activity is allowed on a personal device? Who is responsible for granting the permission to use a device on the network?