Deploying ASM within a large corp...

What level of risk and security is required, what about changes to apps/policies, who will manage the policies? What extra features such as XML profiles or DataGuard are required? How detailed should the policy be ie it can be specific to URLs, file types, parameter names, values, cookies, methods. You control these both in terms of configuration and in terms of the blocking mask.

Plan to give yourself a week or so if you want to run policy builder and plan for a test rig to send plenty of traffic through the device.