Free tool

Security Policy Starter Pack

Get sensible, plain-English security policies in place in an afternoon. Answer a few questions about how your organization works, pick the policies you need, and get editable drafts you can print, share, and have your team sign.

🔒 Everything stays in this browser — nothing is uploaded. Back up to a file if you want to keep or share your work.

These are starting points, not legal advice. Review every policy with your legal and HR advisers and adapt it to your organization before adopting it. Using these templates doesn't by itself make an organization compliant with any law, regulation, contract, or framework.

🔒 Saved only in this browser.

1. Your organization

These details fill in the policies. Anything left blank shows up as a [placeholder] to fill in later.

Organization name

Policy owner (name, title) Approved by (name, title)

Effective date Review frequency

Call your people Document status

IT support contact Security incident reporting contact

2. How you work

Company-managed laptops/computers? Personal devices (BYOD) allowed for work?

Cloud email / productivity suite? Remote work allowed?

Multi-factor authentication (MFA) available? Company password manager provided?

Tone for enforcement sections

3. Policies to include

Policies to include

4. Print and share

Printing includes a cover page and table of contents. Choose "Save as PDF" in the print dialog to make a PDF.

5. Review and edit each policy

Policy text (editable, Markdown)

Your edits are saved per policy. Once you edit a policy, only exact matches of your old organization details are updated in it, and "Start a new review" updates its version, date and revision history — use "Reset to template" to regenerate it completely. Text in [square brackets] is a placeholder to replace.

Policies are step one. AffinityOne tracks whether your controls actually work — assessments, evidence, and remediation. Get early access

How to roll these out

Review with legal and HR. Employment law, privacy law, contracts, and industry rules differ by location and sector. Have your advisers check the wording — especially monitoring, discipline, and personal devices — before anything is published.
Make them true. Only adopt rules you actually follow or will put in place. If a policy says MFA is required, make sure it's turned on. Replace every [placeholder].
Get sign-off. Have the approver formally approve the final versions and set the effective date, then switch the document status to Final.
Train and explain. Walk your team through the key points — especially how to report incidents and phishing — rather than just emailing a PDF.
Collect acknowledgements. Ask everyone to sign the acknowledgement form, and include it in onboarding for new starters.
Review on schedule. Revisit the policies at least annually and after any significant incident or change, and update the revision history each time.