Policies

Using policy templates

Last updated November 2026 · 4 min read

Auditors will ask to see written policies before anything else. ReadySOC includes ten ready-made templates so you are never starting from a blank page.

The ten templates

Information Security Policy
Access Control Policy
Incident Response Plan
Change Management Policy
Risk Assessment Policy
Vendor Management Policy
Business Continuity and Disaster Recovery Plan
Data Classification and Retention Policy
Acceptable Use Policy
Privacy Policy (Internal)

Each card shows which controls the policy supports. The same policy links also appear on the matching control in your Controls list.

From template to approved policy

Choose a templateOpen Policies in the sidebar and click Use this template. Your company name and today’s date are filled in for you.

Fill in the highlighted detailsAnything in [square brackets] is something only you know: a person’s name, a tool, a time limit. Replace each one with what your company really does.

Edit freelyChange, add or delete anything. Use ## Heading for a section title and a dash at the start of a line for a bullet point. Click Save changes.

Get it approvedAn admin clicks Approve policy. ReadySOC records who approved it, the date and a version number, and sets a review date one year out.

Save it as evidenceClick Print / PDF, save the page as a PDF, then upload it to each related control as evidence.

Only promise what you do. Auditors test whether you actually follow your policies. If a template says you review access every quarter, you need to do that and keep a record. Change the wording to match reality.

If you edit an approved policy

Saving a change to an approved policy moves it back to Draft. It needs to be approved again, which creates a new version. This keeps a clear trail of who approved which wording.

Yearly reviews

Policies should be reviewed at least once a year. When a policy is past its review date, its card shows a Review due tag. Read it through, update anything that changed, and approve it again.

Tip: Start with the Information Security, Access Control and Incident Response policies. They cover the most controls and are the first ones auditors ask for.