Who can help write or review our SaaS security policies?
Written by PolicyDrafters. Published .
The person who runs a control should own its policy, whoever writes it. A template, an AI draft, a consultant, a virtual CISO, a compliance platform or a drafting firm can produce the text, and a law practice answers questions about your legal position. Choose by who will read the documents against practice and who will keep them current.
Who should own the policies, whoever writes them?
The first enterprise security questionnaire usually arrives on the desk of whoever is nearest: a founder, an operations lead, or the first engineer with security in their title. It asks for the information security policy and a set of topic policies, and the question that follows is who should write them. Before choosing a writer, it helps to separate writing from owning, because the routes below differ in who writes and hardly at all in who owns.
The top document is the information security policy, and it commits the company as a whole, so as a matter of good practice it is approved by the most senior people in the company; in a startup that usually means the chief executive or the founders. What a customer typically expects is practical: a policy that names who approved it and when, and that matches what the reviewer later finds when they ask for evidence.
Good practice goes one step further. The person who runs a control should own the procedure that describes it, because they are the one who will be asked whether it is true. The engineering lead who grants and removes access should own the access control policy; whoever carries the pager should own the incident response procedure. A writer from any of the routes below can produce excellent text, but only an owner inside the company can keep it honest.
Can we write them in house?
Writing in house has the best fit and highest cost in time. The people who run the systems know the facts, so the first draft describes real practice, not an assumed one. But they are usually building the product, and policy writing is a skill of its own: stating a control so a reader can test it, naming the record that proves it, and keeping six documents from contradicting each other. An in-house draft is most likely to stall at the incident response procedure, because the steps, roles and notification times all have to be decided rather than described.
In house works best when one person holds the pen across the set, the control owners each review their part, and someone outside the writing reads it once before it goes to a customer.
Is a template or a policy pack enough?
A downloaded template or a policy pack from a vendor gives you structure and wording on the day you buy it. The trade, set out in our guide to templates and drafted policies, is that the work of making each sentence true stays with you. A template names controls the vendor assumed you run, and it is current as of the day it was written. If you edit it honestly with the control owners in the room, it can serve a small team well. Adopted unread, it becomes a document a reviewer can compare to practice and find wanting.
Can an AI tool draft them?
An AI-assisted draft is useful for structure and a first pass. It can propose a table of contents, explain what a control is for and turn rough notes into readable sentences in minutes. The real risk is that it writes with confidence about controls you do not run, such as a quarterly access review nobody performs, and that it cites rules, editions or control numbers that have since been replaced. A draft built on older material reads as current until someone checks each reference against the text in force today.
An AI draft therefore needs the same honest edit as a template, by the same control owners, and the same outside read before a customer sees it. It shortens the writing; it does not shorten the checking.
What does a freelance writer or consultant add?
A freelance writer or an independent security consultant brings experience of what reviewers ask and how other companies have answered. A good one interviews your control owners and writes from what they say, which solves the in-house time problem without losing the facts. What varies is scope and continuity: the engagement ends when the documents are delivered, the price is often set by the hour, and the documents depend on that person's knowledge of the current rules. Ask who reviews the work, what is included if the first draft is wrong, and who will update the set when a rule moves.
Where do a virtual CISO or a compliance platform fit?
A virtual CISO is a part-time security leader who sets the programme, decides which controls to run and often writes or commissions the policies as part of it. That is the right route when the company needs security leadership, not only documents, and the policies are one output of a wider piece of work.
A compliance automation platform generates policies alongside monitoring of your systems, usually as part of a SOC 2 or ISO 27001 programme. The policies arrive quickly and are tied to the controls the platform tracks, which is a real advantage when you are already running that programme. They start from the platform's own library, so they need the same edit for your facts, and they tend to sit inside the subscription, which matters if you later change tools. Both routes suit a company whose questionnaire is the start of a formal audit rather than a one-off request.
When do you need a law practice?
A law practice is the route when the question is the organisation's legal position: how a particular rule applies to you, what a customer contract commits you to, or what a regulatory filing should say. A law practice gives advice on those questions, which no drafting route does. Most security policies, though, describe operational controls rather than legal positions: an acceptable use or backup policy sets out how the company works, not how a rule applies to it. Where a contract sets security obligations, the policies are drafted to match what the contract says; reading the contract itself is a question for a law practice.
What does a fixed-price drafting firm do?
A fixed-price drafting firm such as PolicyDrafters writes the documents from an intake against a named rule, at a price quoted before work starts. Our information security policy set is six documents: an information security policy, an access control policy, an acceptable use policy, an incident response procedure, a business continuity and backup policy, and a vendor and third-party policy.
They are drafted against ISO/IEC 27001:2022 Annex A and the security criteria of the AICPA Trust Services Criteria used in SOC 2 reports, and against your customer's questionnaire when you send it. The intake asks how access is granted and removed, how incidents are reported, how backups are taken and tested and which vendors hold your data. Where you have no practice yet, it offers the common options and you pick one you will follow.
Our legal team reviews each document before it reaches you, you mark what you want changed, and we revise once. The first draft arrives twelve working days from a complete intake. The final set comes in Word and PDF with a document ID on every page, for $1,200 to $2,500.
Under the maintenance plan, when Annex A or the Trust Services Criteria move, a revised set arrives with the changes marked. If you already hold policies from another route, a policy review and update reads each one against the current text of the rules it names for $350 to $500 per document. What stays with you is ownership, the decision to adopt, running the controls, the evidence that they operate and your answers to any questionnaire. More on the sector sits on the SaaS and technology page.
How do the routes compare?
| Route | What it gives you | What stays with you |
|---|---|---|
| In house | Documents written by the people who know the facts | The writing time, the consistency across the set and an outside read |
| Template or policy pack | Structure and wording today, at a low price | Making each sentence true, and noticing when the rule changes |
| AI-assisted draft | A fast first pass and a usable structure | Removing controls you do not run, checking every citation, and a reviewer |
| Freelance writer or consultant | Experience of what reviewers ask, written from interviews | Checking scope and review, and finding someone to update the set later |
| Virtual CISO | Security leadership, with policies as one output | Running the programme the role sets, and the cost of the engagement |
| Compliance platform | Policies tied to monitoring inside a SOC 2 or ISO 27001 programme | Editing the library text for your facts, and the documents if you change tools |
| Law practice | Advice on your legal position, contracts and filings | The operational policies, which are usually outside a legal engagement |
| Fixed-price drafting firm | Six documents from an intake, reviewed by our legal team, one revision, Word and PDF; kept current if you add the maintenance plan | Ownership, adoption, and running the controls the documents describe |
- In house
- What it gives youDocuments written by the people who know the facts
- What stays with youThe writing time, the consistency across the set and an outside read
- Template or policy pack
- What it gives youStructure and wording today, at a low price
- What stays with youMaking each sentence true, and noticing when the rule changes
- AI-assisted draft
- What it gives youA fast first pass and a usable structure
- What stays with youRemoving controls you do not run, checking every citation, and a reviewer
- Freelance writer or consultant
- What it gives youExperience of what reviewers ask, written from interviews
- What stays with youChecking scope and review, and finding someone to update the set later
- Virtual CISO
- What it gives youSecurity leadership, with policies as one output
- What stays with youRunning the programme the role sets, and the cost of the engagement
- Compliance platform
- What it gives youPolicies tied to monitoring inside a SOC 2 or ISO 27001 programme
- What stays with youEditing the library text for your facts, and the documents if you change tools
- Law practice
- What it gives youAdvice on your legal position, contracts and filings
- What stays with youThe operational policies, which are usually outside a legal engagement
- Fixed-price drafting firm
- What it gives youSix documents from an intake, reviewed by our legal team, one revision, Word and PDF; kept current if you add the maintenance plan
- What stays with youOwnership, adoption, and running the controls the documents describe
Which route fits your company?
Three questions settle most cases. The first is who will read the documents and compare them to practice. If the answer is your own staff, a template edited honestly or an in-house draft is often enough. If it is an enterprise customer's security team, a SOC 2 auditor or an ISO 27001 certification body, the documents need to state controls you can show, in the order the reader expects.
The second is how many rules and jurisdictions apply. One customer questionnaire built on one framework is a narrow brief. A company answering ISO/IEC 27001, SOC 2 and a privacy law in two regions has documents that must reconcile those rules, and that reconciling is the drafting.
The third is whether anyone will keep the set current. Policies are approved once and read for years. If nobody inside the company will watch the rules and the practice and revise the documents when either moves, choose a route that includes that work, or name the person who will do it before you start.
Many companies combine routes: a virtual CISO or the first security hire sets the programme, a drafting firm writes the set, and the control owners each own their part.
What none of these routes does
None of these routes, PolicyDrafters included, establishes security on its own, passes an audit or earns a certification. A policy describes a control; the organisation has to run it. An auditor or a customer typically reads the policy first and then asks for the record that shows the control operating, such as the last access review or the notes from the last incident. The best-written policy set is worth what the practice behind it is worth, which is why the owner matters more than the writer.
Questions
- Can we draft our security policies with an AI tool and have them reviewed?
- Yes. An AI draft can be sent for a policy review and update like any policy someone else wrote. Each document is read against the current text of the rules it names, returned with the changes tracked and a change note saying what moved and why, and reviewed by our legal team. A review is $350 to $500 per document, fixed before we start.
- Will a set of security policies get us a SOC 2 report or an ISO 27001 certificate?
- No set of policies earns a SOC 2 report or an ISO/IEC 27001 certificate on its own, whoever writes it. The set is the written policy layer an auditor asks to see, structured the way auditors expect to read it. Whether the controls it describes are in place and operating is your operation, not the document.
- Who in a SaaS company should sign off the information security policy?
- As a matter of good practice, the information security policy at the top of the set is approved by the most senior people in the company, because it commits the company as a whole; in a startup that usually means the chief executive or the founders. The topic policies beneath it are best owned by the people who run each control, such as the engineering lead for access control and the on-call lead for incident response.
- Do we need a lawyer to write our security policies?
- Most security policies describe operational controls, such as access, devices, backups and incidents, rather than a legal position. A law practice answers the questions that are about your organisation's legal position: how a rule applies to you, what a contract commits you to, or what a regulatory filing should say.
The documents this guide is about
Applies to
Information security policy set
An information security policy set is the group of written policies and procedures that states how a company protects its systems and data: who may access what, how staff may use company devices, how incidents and outages are handled, which vendors may hold the data, and who owns each control.
$1,200 to $2,500
12 working days
Policy review and update
Policy review and update is a check of an existing policy against the current text of the rules it names and the facts it states, returned as a marked-up copy, a revised version with every change tracked and a change note saying what moved and why.
$350 to $500 per document reviewed
5 working days