Information Security Policy Set Template

Before writing anything, collect the documents that already bind you. NIST's Cybersecurity Framework 2.0 includes the outcome that legal, regulatory, and contractual requirements regarding cybersecurity¹ are understood and managed. In practice, they come from four places, and those decide which rules belong in your policies.

Insurers rely on your cyber insurance answers, such as whether you enforce multi-factor authentication. An insurance reference publisher, the International Risk Management Institute, explains that a material misrepresentation³ on an application can let an insurer deny a claim or rescind the policy. It depends on the law and the policy wording.

NIST's control catalog, SP 800-53, says a policy should address purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance⁴. It also warns that simply restating controls is not a policy, so say who does what at your company.

• Purpose: two sentences on what the policy governs and who outside the company needs it
• Scope: the systems, data and people it covers, including contractors and service accounts
• Rules: a numbered list, one testable rule per item, each with an owner
• Exceptions: a pointer to your exception procedure, never exceptions in the body
• Owner and review: a named role, a review interval and triggers for an early review

Keep the top-level policy short: management's commitment, who approves changes and how the topic policies fit together. Topic policies typically cover access control, acceptable use, backups and recovery, change management, encryption, data retention, incident response, logging, vendors and vulnerability management.

Small companies can stay lean. AICPA's 2022 guide to SOC 2 audits notes that a smaller organization may have policies and procedures that are less formal and detailed⁵ but sufficient for its risks.

Treat any sentence with shall, must or will as a rule, and any with a frequency or number too. Each rule needs one owner, one action, a frequency or threshold, and the system that records it. Split compound sentences: reviewing access and revoking it are two rules.

Every frequency word multiplies. Daily means 365 dated records a year, weekly 52 and quarterly four. AICPA's SOC 2 guide has auditors weigh the frequency of the controls' application⁵ when deciding how much to test, and their report lists every deviation they find.

So write the frequency you already meet. NIST leaves even the policy review interval as an organization-defined frequency⁴, a blank you fill. Avoid "where practicable", which makes a rule untestable, and "periodically", which leaves the number to someone else.

If you started from a downloaded template, count its rules before editing a word. Then find what requires each one and check the system that would prove it. Record what it shows, with a number: "reviews happen" proves nothing, while "two reviews completed this year" does.

Some template rules are outdated. A 90-day password change rule contradicts NIST's digital identity guidelines, revised in July 2025. They say systems shall not require users to change passwords periodically⁶ but must force a change when there is evidence of compromise. If your identity provider has rotation off and nothing you're bound by requires it, fix the policy, not the setting.

For an amendment, first decide which end moves. If the practice is weak, such as critical vulnerabilities fixed in 11 days against a 7-day promise, fix the practice. If the number was arbitrary, fix the sentence, but only where its source allows: you can't loosen a contract deadline by editing your own policy.

Have management approve the set and give it a version number. Ask everyone with access to your systems, contractors included, to acknowledge that version by a deadline, such as 10 working days. Keep signed forms where an auditor can still find them.

Handle departures as time-limited exceptions, each with a scope, a compensating control, an approver and an expiry date. An exception renewed every year is really an amendment. Review the set on a schedule and after the audit findings, incidents and changes in law⁴ that NIST lists as reasons to update a policy.

Some laws also set record-keeping rules. In the US, the HIPAA Security Rule requires covered entities and business associates to keep their security policies in writing. They must retain them for 6 years⁷ from creation or from when they were last in effect, whichever is later.

Some rules lean on other documents: removing a leaver's access on an employee offboarding checklist, and breach notification deadlines on your security incident response plan. Answer customers' security questionnaires from the same evidence. The register in this page's template traces each rule to its source, and Edit with AI has River fill it in from your documents.