Restoring your saved mode and lab work…
Select controls that address the risks you identified. A policy statement is not enough: every control needs an owner, operation and evidence.
For every selected control: what would prove this exists, is used and reduces the risk?