The documents your customer, auditor or new team just asked for.
When a security questionnaire, procurement request, privacy review or first hire exposes a gap in your paperwork, we draft the missing policies and procedures from your intake, reviewed by our legal team. The price is fixed before we start.
$350 to $500 for a policy, $1,200 to $2,500 for a suite, $3,000 to $5,000 for a bespoke manual. Fixed before we start.
PD-HB-0042; rev 2026-09; reviewed
Employee handbook
Contents
- 1Employment basics
- 2Leave
- 3Conduct
- 4Performance and discipline
- 5Grievances
- 6Leaving
2Leave
2.1Each type of leave in this handbook has a rule, a request route and a record. The rule says who may take it and for how long; the request route says who approves it; the record says where it is written down.
What has come up?
A questionnaire, procurement checklist, new hire or audit asks for a policy. Each entry names the document that answers it and its price band, fixed before we start. Every document is reviewed by our legal team and delivered in Word and PDF.
A customer sent a security questionnaire
Six policies drafted against ISO/IEC 27001:2022 Annex A and the SOC 2 security criteria, so that each question has a clause to point at, with a control table of the questions each document answers. The answers themselves still describe the controls you actually run.
$1,200 to $2,500
First draft in 12 working days.
Procurement asked to see your policies and procedures
The policy set and the written procedures a customer's onboarding or vendor review asks for, drafted to be read question by question, or a single policy at $350 to $500 where one document is the gap.
$1,200 to $2,500 a set
First draft in 12 working days.
A privacy notice and a cookie notice are due
The external privacy notice, the cookie notice and the internal data protection policy, drafted against GDPR, the CCPA and Nigeria's Data Protection Act. The cookie notice is written to sit inside a consent banner that you or your developer configure.
$1,200 to $2,500
First draft in 10 working days.
A growing team needs a handbook and written procedures
An employee handbook with a leave section that works and an acknowledgement form to sign, and the procedures a new starter can follow, kept as an SOP library on one template.
$1,200 to $2,500 each
First draft in 10 to 12 working days.
A regulator, a bank or an examiner expects a written manual
Documents drafted against a named rule and structured the way the people who check them expect to read: the AML/KYC manual, and the AI governance suite for a business that builds or uses AI.
$3,000 to $5,000
First draft in 15 to 20 working days.
Policies you already have need checking
Documents someone else wrote, read against the current text of the rules they name and returned with every change marked and a note of what moved, before a customer or an auditor reads them.
$350 to $500 per document reviewed
Returned in 5 working days.
Who writes a business’s policies and procedures?
A policy is approved by the people who carry the risk, usually leadership or a board, and a procedure is owned by the person who runs the process. Someone still has to draft both so that an auditor, a regulator or a new starter can read them.
The guides explain what separates a policy from a procedure and how often each should be reviewed, and by whom: at least yearly, and whenever a rule or fact it relies on changes.
At PolicyDrafters our senior team drafts and our legal team reviews: our own staff and the independent specialists we work with regularly, and every draft is reviewed before it is finalised, with the review recorded in the document’s revision block. Each document is written from your intake, so it says what you do, not what a template assumed. One revision round covers the changes you ask for.
A drafted document is not always the right purchase. Where a template edited honestly, an AI-assisted first draft or a lawyer’s advice on your position is the better route, we say so; the guide on templates against drafted policies sets out the test, and the guide on who can help write or review SaaS security policies compares the routes.
Drafters Collective LLC, trading as PolicyDrafters, with its registered office in Albuquerque, NM.
Five steps from your intake to a reviewed document
1. Submit your requirements
The intake asks what the document is for, who will read it, which rules it answers to and what you already use. You can send files once we reply.
Ends with a complete intake.
2. Receive a fixed quote
You get a quote in one of three price bands. It is fixed before we start and does not change.
Ends with a written quote, $350 to $500, $1,200 to $2,500 or $3,000 to $5,000.
3. We research and draft
We check the current text of the rules you named and draft against them, in sentences the people who will use the document can follow. Our legal team reviews the draft before it leaves us, and the review is recorded in the revision block.
Ends with a reviewed first draft.
4. You review
You read the reviewed draft, mark what you want changed, and send it back.
Ends with your marked‑up draft.
5. We revise and finalise
One revision round is included. The final document arrives in Word and PDF with a document ID and revision block, and is filed for the maintenance plan.
Ends with the final in Word and PDF, with ID and revision block.
Three price bands, one maintenance plan
Every quote lands in one of three bands, and the figure is fixed before we start. The maintenance plan is billed monthly and keeps a document current when the rule it names changes.
Single policy
$350 to $500
One policy, one jurisdiction: a new policy drafted, or an existing one reviewed and updated.
Themed suite
$1,200 to $2,500
A handbook, a pack, or a set of five to twelve related documents.
Bespoke manual
$3,000 to $5,000
A full manual or suite drafted to your process.
Maintenance plan
Kept current as the rule changes, billed monthly.
$29 to $99 a month
What each sector has to show, and the documents that answer it
SaaS and technology
For enterprise buyers, auditors and investors: the information security policy set, the privacy policy pack and, where the product uses AI, the AI governance suite.
Information security policy set from $1,200.
Financial services
For the regulator, the bank that onboards you and the auditor: the AML/KYC manual, the information security policy set and the privacy policy pack.
Information security policy set from $1,200.
Small business HR
For staff, managers and the investor or insurer who asks: the employee handbook, the HR procedures behind it and a review of the policies you already have.
Policy review and update from $350 per document reviewed.
Healthcare administration
For patients, the compliance officer and the auditor: administrative SOPs, the privacy policy pack and the information security policy set, never clinical procedures.
SOP library from $1,200.
Guides to the rules behind the documents
A customer sent us a security questionnaire. What do we do next?
Read it whole, give each section an owner, and answer with the control you run and the evidence you hold. A documented gap with a date and a plan is a normal answer.
Published
Which policies does a SaaS startup need before its first enterprise deal?
The eight policies a SaaS startup's first security questionnaire asks for, mapped to ISO 27001, SOC 2, the CAIQ and VSAQ, with a ninth where the product uses AI.
Updated
What is the difference between a privacy notice and a cookie consent setup?
A privacy notice says what data you collect and why; a cookie consent setup asks before trackers run and records the answer. What each needs and who builds it.
Published
When does a growing business need an employee handbook?
No US federal law requires a handbook. The need is practical: a first manager who is not a founder, a first remote hire, a first leave request or an investor's request.
Published
What goes in an AML/KYC manual for a small financial services firm?
The ten sections an examiner expects in an AML/KYC manual, in order, from business-wide risk assessment to independent review, with the rule and record behind each.
Updated
Policy templates vs drafted policies: when is a template enough?
A template is enough when the rule is generic, nobody will audit it and you will edit it honestly. It stops being enough when a reader compares it to what you do.
Updated