Policy statements need to be tied to risks. Each policy statement is a control to reduce a risk to the organisation.
So, in this scenario, you need to identify the risks to the organisation and to determine what high-level controls should be in place to reduce those risks.
A good policy needs to make a difference between a policy ("strategy") and procedures ("tactics"). A policy should not specify how to do something, but what the approach is to gain a desired outcome. That way the policy can be applied no matter what the technology is. This can be a very difficult line to walk and many policies blur this line in practice.
So, from a high-level, outcome-based perspective, how should the organisation approach the email server given that it processes sensitive emails?
There are many corporate email policies online for you to use as inspiration. Writing information security policies is an art and getting practice is a very good thing.