Formulating IT Security Policy