Start with what is written
Most organizations already have a written cybersecurity policy. It may be uneven or out of date, but it is the organization's stated expectation, and people have already agreed to it.
That makes it the right starting point for a federated program.
From policy to objectives
Take each requirement in the policy and map it to the control objectives in the framework the program uses. One policy statement often maps to several objectives.
The policy baseline
The objectives the policy requires, taken together, form the policy baseline. It expresses the policy in the same terms as a resource team's control inventory, so the two can be compared directly.
A stricter minimum, where there is one
Some organizations hold themselves to a minimum security standard that goes beyond their written policy. If so, build a second baseline for it. The two can then be measured separately.
What the baselines are for
Laid over security plans and control inventories, the baselines show how far each resource is from what the organization expects. They focus effort on the gaps that matter and give every team the same target.
A QuickPlan focused on the policy gives teams a narrowed place to begin. A Security Plan in an Hour explains QuickPlans.
Bring in what already exists
Security plans that were written before the program began are worth keeping. Importing them gives their teams a head start and gives the program its first coverage.
The first target to aim for with those baselines is described in The Operational Minimum.