What needs to be included as part of an organizations Phishing Policy? 

Q.  What needs to be included as part of an organizations Phishing Policy?

Note: 300 words with intext citations and 2 references needed.