Start with a policy or trust model
resources from the sans institute