Policies for internal applications

Hi,
I am looking for policies that are suitable for internal applications (for only corporate users) that are not exposed to internet.

Thanks
Saeed