Blog · Security policies · Problem 2 of 93
Procurement wants your security policies. Write real ones in days.
· 3 min read · By Case Jones
A buyer's procurement team has asked for your information security policies before they sign. You have good habits and a few docs in a wiki, and no policies anyone would call policies.
What it costs to leave it
Procurement teams work from a checklist, and a missing item stops the paperwork until someone fills it. Sending a downloaded template with another company's name in it is a common way to lose trust in one email. Policies that describe practices you do not follow can also come back to haunt you in an audit or a dispute.
How to write policies that are short, true and enough
A policy says what your company commits to and who owns it. It does not need to be long, and it should describe how you really work.
- 1
Find out exactly which policies they want
Ask procurement for their list, or look at the request again. Most ask for some mix of an information security policy, acceptable use, access control, incident response, business continuity, vendor management, data retention and change management. Write those first and stop there for now.
- 2
Write down what you already do
Before writing any policy, spend thirty minutes listing your real practices. Who gets admin access, how laptops are set up, where backups go, what happens when someone leaves. A policy built from this list will be true on day one.
- 3
Keep each policy to a page or two
Each one needs a purpose, who it applies to, the rules, an owner and a review date. Use must for the rules you follow and drop anything you would not enforce. Short policies get read, by your team and by the buyer.
- 4
Give every policy an owner and a version
Put a name, an approval date and a version number at the top. Reviewers look for this because it shows someone is responsible and the document is kept up. Plan to review each one at least once a year.
- 5
Share them in a way you control
Send a PDF and mark it confidential, so nobody edits it by accident. Many companies share full policies only under an NDA and send a one-page summary otherwise. Keep a list of who received which version.
Example
A short access control rule that is easy to follow and easy to prove
Access to production systems is granted only by the CTO, on request in our ticket system, and only for the role's needs. All accounts use single sign-on with multi-factor authentication. Access is removed on the employee's last day. Access is reviewed every quarter and the review is recorded.
Or let the policy builder write the first drafts
The policy builder in 93 Compliance works out which SOC 2 documents you need. An AI policy assistant writes and customizes each one, researching as it writes. It can give your first policies a head start by reading your website, evidence documents you upload and questionnaires you have already answered.
Every edit arrives as a tracked change for the policy owner to accept. You can test each document against SOC 2, HIPAA, PCI DSS, ISO 27001, GDPR, PIPEDA or a customer's questionnaire, then download it as a Word file. All free.
- The list of SOC 2 documents you need
- Drafts written from how your company works
- Tracked changes for the policy owner to accept
- Tests against SOC 2, ISO 27001, HIPAA and others
- Free Word downloads
Build your policies free
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Can I just use a free security policy template?
You can start from one, but read every line and change it to match how you work. Templates often promise things a small company does not do, like a security committee or annual penetration tests. Anything you leave in is a promise.
How many security policies does a small company need?
For most buyer requests, six to ten covers it. Some companies combine several topics into one information security policy, which is fine if it is clear and has an owner.
Who should approve our policies?
Someone with authority to enforce them, usually the CEO or CTO at a company your size. Record who approved each one and when.