Some considerations in building a future-ready IT policy