Guides to policies, procedures and the rules behind them
Each guide answers one question a buyer asks before commissioning a document. The answer comes first, then the depth, with the regulation or standard cited where it is the source.
14 guides, 70 primary sources cited.
The foundations
What is the difference between a policy and a procedure?
A policy states the rule and who it applies to; a procedure states the steps, owners and records. Most documentation fails by mixing the two. How to keep them apart.
Updated , with 3 primary sources cited.
Updated , with 3 primary sources cited.
Policy templates vs drafted policies: when is a template enough?
A template is enough when the rule is generic, nobody will audit it and you will edit it honestly. It stops being enough when a reader compares it to what you do.
Updated , with 6 primary sources cited.
Updated , with 6 primary sources cited.
How often should company policies be reviewed, and by whom?
Annually by convention, and whenever the rule or the facts change, after an incident or an audit finding. Who reviews, who re-approves, and how the review is recorded.
Updated , with 5 primary sources cited.
Updated , with 5 primary sources cited.
What is an SOP, and how do you write one people actually follow?
A standard operating procedure is a numbered set of steps for one process, with an owner and a record for each step. How to capture, write, test and review one.
Updated , with 3 primary sources cited.
Updated , with 3 primary sources cited.
Documents, regulations and standards
How much does it cost to have an employee handbook written?
Templates cost least, legal practices most. A drafted handbook is priced by jurisdictions, headcount, existing documents and extra policies, then quoted as one figure.
Updated , with 8 primary sources cited.
What goes in an AML/KYC manual for a small financial services firm?
The ten sections an examiner expects in an AML/KYC manual, in order, from business-wide risk assessment to independent review, with the rule and record behind each.
Updated , with 10 primary sources cited.
GDPR, CCPA and NDPR privacy notices: what has to be in each?
GDPR, CCPA and Nigerian notices state identity, data, purposes, recipients, retention and rights; GDPR and Nigeria add lawful basis, the CCPA a sale or sharing opt-out.
Updated , with 7 primary sources cited.
Which policies does a SaaS startup need before its first enterprise deal?
The eight policies a SaaS startup's first security questionnaire asks for, mapped to ISO 27001, SOC 2, the CAIQ and VSAQ, with a ninth where the product uses AI.
Updated , with 12 primary sources cited.
What documents does the EU AI Act require from a deployer of AI?
What the EU AI Act, Regulation (EU) 2024/1689, asks a deployer to document: Article 26 duties, Article 27 impact assessment, Article 4 literacy and Article 50 notices.
Updated , with 14 primary sources cited.
NIST AI RMF vs ISO 42001: which one should a small company document against?
Document against the framework your customers name: NIST AI RMF 1.0 for alignment, ISO/IEC 42001:2023 for certification. If nobody asks, start with the shared documents.
Updated , with 6 primary sources cited.
A customer sent us a security questionnaire. What do we do next?
Read it whole, give each section an owner, and answer with the control you run and the evidence you hold. A documented gap with a date and a plan is a normal answer.
Published , with 4 primary sources cited.
Who can help write or review our SaaS security policies?
Your own team, a template, an AI draft, a consultant, a virtual CISO, a platform, a law practice or a drafting firm: what each route gives you and what stays with you.
Published .
What is the difference between a privacy notice and a cookie consent setup?
A privacy notice says what data you collect and why; a cookie consent setup asks before trackers run and records the answer. What each needs and who builds it.
Published , with 9 primary sources cited.
When does a growing business need an employee handbook?
No US federal law requires a handbook. The need is practical: a first manager who is not a founder, a first remote hire, a first leave request or an investor's request.
Published , with 8 primary sources cited.