Firms need a written policy, paired with the technical controls to back it up, and reviewed at least once a year.