Policies and Procedures should be implemented based on a progressively hardening cycle, starting with the easiest and highest impact – to minimise any operational business disruption and maximise effectiveness of protective measures