I've recently been tasked with putting together a security policy for a small startup firm consisting of ~30 people in the UK. Largely up until now there has been nothing concrete in place, however as we're looking to take on clients in the financial and banking services sector this needs to change.
Having very little security experience (I'm a software engineer by day); and working on a very tight deadline, I'm hoping that there are off the shelf templates/guides I can use to aid in drafting this policy. Additionally what would one expect to see in a robust security policy i.e. one a financial service firm might be happy with?