Acceptable Use Policy
Defines acceptable and prohibited uses of company systems, devices, and networks.
SOC 2ISO 27001
See sample PDFLibrary
All policy templates
60 bilingual templates covering 38 compliance frameworks. Generate the policy that fits your context in minutes.
60 templates
Access Control Policy
Defines how users gain, change, and lose access to systems and data.
SOC 2ISO 27001
See sample PDFAI Acceptable Use Policy
Defines how employees may use generative AI and machine-learning tools — public chatbots, copilots, embedded assistants.
AI ActISO 42001ISO 27701SOC 2
See sample PDFAI Governance Policy
Defines how AI systems are designed, evaluated, deployed, and overseen — aligned with the EU AI Act and ISO/IEC 42001.
AI ActISO 42001ISO 27701GDPR
See sample PDFAnti-Bribery & Corruption Policy
Prohibits bribery and corruption in any form, aligned with FCPA (US), UK Bribery Act, Sapin II (France), and ISO 37001.
FCPAUK-BRIBERY-ACTSAPIN2ISO37001
See sample PDFAnti-Phishing & Social Engineering Policy
Establishes how the workforce recognises, reports, and is protected from phishing, vishing, smishing, and social engineering attacks.
ISO 27001SOC 2NIS2HIPAA
See sample PDFAPI Security Policy
Defines security requirements for internal and external APIs across design, deployment, and decommissioning.
ISO 27001NISTOWASPSOC 2
See sample PDFAsset Management Policy
Defines how IT assets are inventoried, classified, owned, and decommissioned.
SOC 2ISO 27001
See sample PDFBackground Check Policy
Defines pre-employment background verification appropriate to role sensitivity, in compliance with local labour and privacy law.
ISO 27001SOC 2GDPRNIS2
See sample PDFBackup & Recovery Policy
Defines how data is backed up, retained, and restored to ensure business continuity.
SOC 2ISO 27001
See sample PDFBusiness Continuity Policy
Establishes the business continuity management system aligned with ISO 22301 — BIA, plans, exercises, governance.
ISO 22301DORASOC 2NIS2
See sample PDFBYOD Policy
Defines acceptable use of personal devices for work, with security controls and reimbursement terms.
SOC 2ISO 27001
See sample PDFCapacity Management Policy
Ensures system capacity is monitored and planned to meet current and forecasted business demand (ISO 27001 A.8.6, SOC 2 A1).
ISO 27001SOC 2ISO 22301
See sample PDFCCPA / CPRA Privacy Policy
Discloses consumer rights and data practices under the California Consumer Privacy Act and California Privacy Rights Act.
CCPACPRAGDPRISO 27701
See sample PDFChange Management Policy
Defines how changes to production systems are proposed, reviewed, deployed, and rolled back.
SOC 2ISO 27001
See sample PDFCMMC Policy
Aligns the organization with the Cybersecurity Maturity Model Certification (CMMC) for US Department of Defense contractors and subcontractors.
CMMCNISTDFARS
See sample PDFConfiguration Management Policy
Defines how baseline configurations are established, deployed, and protected from unauthorised change (NIST CM family, ISO 27001 A.8).
NISTISO 27001SOC 2PCI DSS
See sample PDFCookie Policy
Discloses the cookies set on your website, their purpose, retention, and how visitors can manage them.
GDPRePrivacyISO 27701
See sample PDFCrisis Management Policy
Establishes the organization-wide framework for responding to severe events — cyber, safety, reputational, legal — beyond business continuity.
ISO 22301DORANIS2
See sample PDFCryptographic Key Management Policy
Defines the full lifecycle of cryptographic keys aligned with NIST SP 800-57 and FIPS 140-3.
NISTISO 27001PCI DSSFIPS
See sample PDFCyber Essentials Policy
Documents the five technical controls required by the UK NCSC Cyber Essentials and Cyber Essentials Plus schemes.
Cyber EssentialsISO 27001SOC 2
See sample PDFData Loss Prevention Policy
Defines controls to detect and prevent unauthorized exfiltration of sensitive data across email, endpoints, cloud, and network egress.
ISO 27001SOC 2PCI DSSGDPR
See sample PDFData Protection Policy
Defines how personal and sensitive data is collected, processed, stored, and protected, aligned with GDPR essentials.
GDPRISO 27001SOC 2
See sample PDFData Retention Policy
Defines how long data is kept, why, and how it is securely destroyed when retention expires.
GDPRISO 27701ISO 27001
See sample PDFDisciplinary Policy for Cybersecurity Violations
Defines the consistent, proportionate disciplinary process for workforce violations of information security policies.
ISO 27001SOC 2NIS2HIPAA
See sample PDFEmail Use Policy
Defines acceptable, secure, and professional use of company email.
SOC 2ISO 27001
See sample PDFEncryption Policy
Defines cryptographic standards for data at rest, in transit, and key management practices.
SOC 2ISO 27001GDPR
See sample PDFFedRAMP Policy
Aligns a cloud service offering with FedRAMP authorization requirements for use by US federal agencies.
FEDRAMPNISTFISMA
See sample PDFHDS Health Data Hosting Policy
Aligns the organisation with the French HDS (Hébergeur de Données de Santé) certification for hosting personal health data.
HDSGDPRISO 27001ISO 27017
See sample PDFHIPAA Security & Privacy Policy
Establishes safeguards for Protected Health Information (PHI) in alignment with HIPAA Security and Privacy Rules.
HIPAAISO 27701ISO 27001
See sample PDFHITRUST CSF Policy
Aligns information protection with the HITRUST Common Security Framework, used as the de-facto US healthcare standard.
HITRUSTHIPAAISO 27001NIST
See sample PDFICT Third-Party Risk Policy
Manages ICT third-party risk in alignment with EU DORA — including criticality assessment, register, and exit strategies.
DORANIS2ISO 27001
See sample PDFIdentity & Access Management Policy
Establishes IAM principles, identity proofing, authentication, authorisation, federation, and lifecycle management.
NISTISO 27001SOC 2NIS2
See sample PDFIncident Communication Playbook
Defines who communicates what, to whom, and when during a cybersecurity incident — internal, customer, regulator, and public.
ISO 27001SOC 2GDPRNIS2
See sample PDFIncident Response Policy
Defines how the organization detects, responds to, and learns from security incidents.
SOC 2ISO 27001GDPR
See sample PDFInformation Classification Policy
Defines how information is classified by sensitivity and the protections each tier requires.
SOC 2ISO 27001NIST
See sample PDFCloud Security Policy (ISO 27017)
Extends ISO 27001 controls with cloud-specific guidance per ISO/IEC 27017, defining shared responsibility for security in cloud services.
ISO 27017ISO 27001SOC 2ISO 27018
See sample PDFPII Protection in Public Cloud Policy (ISO 27018)
Implements the safeguards for processing PII as a public cloud PII processor in alignment with ISO/IEC 27018.
ISO 27018ISO 27017ISO 27701GDPR
See sample PDFLogging & Monitoring Policy
Defines what is logged, how logs are protected and retained, and how monitoring drives detection and response.
NISTSOC 2ISO 27001PCI DSS
See sample PDFNetwork Security Policy
Defines network segmentation, perimeter and lateral controls, secure connectivity, and zero-trust principles.
NISTISO 27001SOC 2PCI DSS
See sample PDFNIS2 Cybersecurity Risk Management Policy
Establishes the cybersecurity risk-management measures required by EU Directive 2022/2555 (NIS2) for essential and important entities.
NIS2DORAISO 27001ISO 22301
See sample PDFOpen-Source Software Policy
Defines how open-source dependencies are evaluated, approved, monitored, and contributed to.
ISO 27001NISTSOC 2
See sample PDFOperational Resilience Policy
Establishes the framework to identify, protect, detect, respond to, recover from, and learn from operational disruptions (DORA / NIS2 aligned).
DORANIS2ISO 22301
See sample PDFPassword Policy
Defines password requirements and management practices.
SOC 2ISO 27001
See sample PDFPatch Management Policy
Defines how operating system, application, and firmware patches are evaluated, tested, deployed, and verified.
NISTISO 27001PCI DSSSOC 2
See sample PDFPCI DSS Cardholder Data Protection Policy
Protects cardholder data (CHD) and the Cardholder Data Environment (CDE) in alignment with PCI DSS v4.0.
PCI DSSISO 27001SOC 2
See sample PDFPenetration Testing Policy
Establishes the program for authorized adversarial security testing of systems and applications.
ISO 27001SOC 2PCI DSSNIST
See sample PDFPhysical & Environmental Security Policy
Defines protection of facilities, equipment, and the environment supporting information systems (ISO 27001 Annex A.7).
ISO 27001SOC 2PCI DSSHIPAA
See sample PDFPrivacy Information Management Policy
Establishes a Privacy Information Management System aligned with ISO/IEC 27701, on top of ISO 27001.
ISO 27701GDPRISO 27001
See sample PDFRecords Management Policy
Governs the creation, classification, retention, access, and destruction of organizational records (broader than data retention).
GDPRISO 27001ISO15489SOX
See sample PDFRemote Work Policy
Sets security and operational expectations for employees working outside the office.
SOC 2ISO 27001
See sample PDFRisk Management Policy
Defines how risks are identified, assessed, treated, monitored and reported (aligned to NIST RMF and ISO 27005).
NISTISO 27001ISO 27005SOC 2
See sample PDFSecure Software Development Policy
Embeds security through the software development lifecycle (NIST SSDF, ISO/IEC 27034).
NISTISO 27034ISO 27001SOC 2
See sample PDFSecNumCloud Compliance Policy
Aligns the cloud service provider with the French ANSSI SecNumCloud qualification requirements.
SecNumCloudANSSIISO 27001GDPR
See sample PDFSecure Onboarding & Offboarding Policy
Defines the security activities for joiners, internal movers, and leavers — from access provisioning to deprovisioning and exit interviews.
ISO 27001SOC 2NISTNIS2
See sample PDFSecurity Awareness & Training Policy
Defines mandatory cybersecurity training, awareness campaigns, and effectiveness measurement.
NISTISO 27001SOC 2NIS2
See sample PDFTISAX Policy
Aligns information security with the TISAX (Trusted Information Security Assessment eXchange) catalogue used across the EU automotive industry.
TISAXISO 27001GDPR
See sample PDFVendor & Third-Party Management Policy
Defines how vendors and third parties are assessed, contracted, monitored, and offboarded.
SOC 2ISO 27001GDPR
See sample PDFVulnerability Management Policy
Establishes how vulnerabilities are discovered, prioritised, remediated, and verified across the technology stack.
NISTPCI DSSSOC 2ISO 27001
See sample PDFWhistleblower Policy
Provides safe internal and external reporting channels and anti-retaliation protections, aligned with EU Directive 2019/1937 and national implementations.
EU-WHISTLEBLOWERISO 27001SOX
See sample PDFReady to generate your policies?
Create a free account and start drafting your policies in minutes.
Start free