Organizations Phishing Policy

What needs to be included as part of an organizations Phishing Policy?