- Decide what kind of people you want in the community. "Everyone" is not an option. As a community you are a group of like-minded people when it comes to at least one thing, and this is when you decide what that thing is. Write it down.
- Decide what kind of people you do not want in your community. This is going to take longer than step one. This question is harder than "I don't want people who are assholes into my group." Do you want to let sexist or misogynistic people into your community? Do you want to allow racists in? What about people who are very vocal about a specific social issue that you feel runs counter to the kind of people who you want in your community? Write down these broad groups of people.
- If you already have a community, run the groups you listed by everyone in your community. Let them add groups to your list under either column.
- Profile the groups of people you wrote down. What specific actions they take or specific views they hold that make you want/not want them in your community? Think about the personality traits those people have as you do this. Write down at a broad level what kind of language they use that you want/don't want and the things they do that you like/don't like. Being specific here will pay off later.
- Read the code of conduct for other communities/organizations that align with what you want from yours. Keep your notes with you as you do this and refine the specific actions you want/don't want.
- Write down your commandments. Specific and definitive statements, not suggestive or vague statements. 'You will,' not 'you should.' Example: "As a member of this community you will not reduce other people, inside or outside of this community, to aspects of their body. As a member of this community you will hold people accountable against the Code of Conduct. You will report breaches of the Code of Conduct to a moderator. You will not..."
- Decide what will be done when the code of conduct is broken. Specific steps. A warning, temporary ban, permanent ban, etc. These should escalate in a reasonable manner. Unless there are flagrant breaches of the code of conduct these steps should not be skipped when enforcing the code of conduct.
- You are not done. If you have an established community, and moderators you must run this your draft by your community. The current community must agree with and support your choices here. You must run it by all moderators and they must have zero reservations about the code of conduct. If a moderator expresses concern, you have to determine what they have a problem with and why they perceive it as a problem. You will have push-back from moderators who just want to be in charge and who do not wish to uphold a set of rules or be accountable.
- Once everything is signed off, you must publish the code of conduct in an easily accessible location. The Code of Conduct must be easy to find and easy to read and understand. It needs to use simple language so that it cannot be misinterpreted.
Text Source: https://notawfulsecurity.blogspot.ca/2017/07/infosecn00bs-part-2-fixing-problem.html