The old JSPG produced a draft list of topics.
See http://www.jspg.org/wiki/Policy_Framework
I propose:
Security Operations (we have already started here).
Incident Response (we have already started here).
Traceability, logging and auditing.
Data protection and privacy.
Participant responsibilities (Sites, VOs, Users, AUPs).
Legal issues (IPR, liability, escalation, etc.).