I want to begin my answer by saying I work in IT Audit / Security and this answer derives from my profession.
I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security.
This is not only a good idea but essential to protecting your workplace. The benefits for implementing a enterprise IT Security policy are numerous, such as those listed below:
- User accountability
- Protection from liability
- More effective protection of company data and corporate assets
Users accountability is greatly increased as no longer can users say "there is no policy" or "I did not understand / know we had a policy" The liability of the company is somewhat mitigated due to the presence of management responsibility as sign off on these policies would imply. Finally, policies and accompanying procedures set a consistent, reliable method through which information security is implemented at the company.
As to what to include in such an policy, the items you have listed are good for start but are not adequate for the modern workplace.
Essential policies would include among others... but these in my view are more critical.:
- Incident response
- Business continuity and Disaster Recovery
To implement any of these policies, you must have business and management buy in. Without commitment from the top, policies have no teeth. In the end, IT security is essential, but ultimately serves as a way to meet business objectives. IT cannot survive on its own isolated.