Answer a few quick questions, see free examples of real policy language, and get a personalized list of which policies your organization actually needs. Takes about 90 seconds. No signup required to see your results.
Question 1 of 6
Sets the ground rules for access control, data handling, and accountability, one of the first documents examiners will expect to see.
3.4 Access Control: Access to systems containing nonpublic customer information is granted on a least-privilege, role-based basis and reviewed at least quarterly. All privileged and administrative accounts require multi-factor authentication. Access is revoked within one business day of termination or role change.
Documents recovery objectives and testing so an outage doesn't turn into a repeat exam finding.
5.1 Recovery Time Objectives: Critical systems are assigned a maximum tolerable downtime and a recovery time objective (RTO), reviewed annually and validated through a documented BCP test. Deviations identified during testing are logged and tracked to remediation.
Brings structure to third-party risk: tiering, due diligence, and ongoing monitoring, including your MSP.
4.2 Vendor Risk Tiering: Vendors are tiered as Critical, Significant, or Standard based on data access, system integration, and business impact. Critical and Significant vendors require an annual SOC 2 Type II (or equivalent) review and a documented risk reassessment.
Defines roles, escalation, and regulatory notification steps before an incident forces you to improvise.
2.3 Escalation & Notification: Suspected incidents are reported to the Incident Response Lead within one hour of detection. Incidents involving nonpublic customer information trigger the regulatory notification checklist, including applicable state and federal timelines.
Skip the blank page. Every template above is easier to start than to finish. Send us your results and we'll pre-fill your policy set with your organization's name, control owners, vendors, and systems already in place. You review and approve instead of writing from scratch.