Example company · read only
Example Co.
What 93 Compliance looks like a few days in. Everything here is sample content; your own company starts empty and fills in as you go.
I just signed up. Our website is example.co. Read it and tell me which policies and procedures we need.
I read 14 pages of example.co. You sell scheduling software to clinics (3 plans, $49–$499 a month), host on AWS in Canada, and promise 99.9% uptime, encryption at rest and a 72-hour breach notice.
For SOC 2 with 40 people you need 12 documents. Four of your website claims have nothing behind them yet (uptime, breach notice, backups, data residency), so I put the procedures that make them true first: Incident Response, Backup and Recovery, Vendor Management, Access Control.
Shall I draft them?
Yes, start with those four.
Done: 4 drafts are in Documents, with your company details filled in. 6 blanks are left, each a question only you can answer (for example who approves access for engineers). Your 72-hour breach notice now has a procedure behind it.