Skip to content
Get a fixed quote

Information security policy set

Six security documents drafted against ISO/IEC 27001:2022 Annex A and SOC 2 CC6 and CC7, for the questionnaire your customer sent.

Get a fixed quoteSee pricing

$1,200 to $2,500, fixed before we start. First draft in 12 working days.

Updated

PD-IS; specimen page

Information security policy set

Contents

  1. 1Information security policy
  2. 2Access control policy
  3. 3Acceptable use policy
  4. 4Incident response procedure
  5. 5Business continuity and backup policy
  6. 6Vendor and third-party policy

1Purpose

1.1An information security policy set is the group of written policies and procedures that states how a company protects its systems and data: who may access what, how staff may use company devices, how incidents and outages are handled, which vendors may hold the data, and who owns each control.

Specimen: the first page of the information security policy set, as delivered

What it is

An information security policy set is the group of written policies and procedures that states how a company protects its systems and data: who may access what, how staff may use company devices, how incidents and outages are handled, which vendors may hold the data, and who owns each control. ISO/IEC 27001:2022 Annex A control 5.1 asks for these policies to be defined, approved by management, communicated to staff and reviewed at planned intervals, and SOC 2 criterion CC5.3 looks for control activities deployed through policies and the procedures that put them into action.

Who it is for

A SaaS or services company whose first enterprise customer has sent a security questionnaire, a team preparing for a SOC 2 Type 1 report or an ISO/IEC 27001 certification audit, or a firm whose insurer or investor has asked to see the written controls. The set is drafted for the engineer or operations lead who will answer the questionnaire from it, so each policy states a control, an owner and a record. Where you have no practice yet, the intake offers the common options and you pick one you will follow.

A template is enough instead when the rule is generic, no auditor, regulator, customer or court will compare it to your practice, and you will edit it honestly; see the guide on templates against drafted policies.

What you get

6 deliverables, in Word (.docx) and PDF, with one round of revisions.

  • Information security policy
  • Access control policy
  • Acceptable use policy
  • Incident response procedure
  • Business continuity and backup policy
  • Vendor and third-party policy

Which controls each document answers

Scroll sideways for the other columns

DocumentISO/IEC 27001:2022 Annex ASOC 2 security criteriaCAIQ v4.1 domain
Information security policyA.5.1 policies, A.5.2 roles, A.5.4 management responsibilitiesCC2.2, CC5.3GRC, Governance, Risk Management and Compliance
Access control policyA.5.15 access control, A.5.16 identity, A.5.18 access rights, A.8.2 privileged accessCC6.1 to CC6.3IAM, Identity and Access Management
Acceptable use policyA.5.10 acceptable use, A.6.2 terms of employment, A.8.1 user endpoint devicesCC6.7, CC6.8HRS, Human Resources Security, and UEM, Universal Endpoint Management
Incident response procedureA.5.24 to A.5.28 incident management, A.6.8 event reportingCC7.2 to CC7.5SEF, Security Incident Management, E-Discovery and Cloud Forensics
Business continuity and backup policyA.5.29 and A.5.30 continuity, A.8.13 backup, A.8.14 redundancyCC7.5BCR, Business Continuity Management and Operational Resilience
Vendor and third-party policyA.5.19 to A.5.22 supplier relationshipsCC9.2STA, Supply Chain Management, Transparency and Accountability

Most security policy sets fall apart at the incident response procedure. Ours names who declares an incident, who is told and by when, what is recorded, and who signs the post-incident review.

What it costs

$1,200to $2,500

The information security policy set is $1,200 to $2,500. The quote is fixed before we start and does not change. Maintenance is a separate plan, $29 to $99 a month, that keeps the information security policy set current when a rule it names changes.

How the document is made, from intake to delivery, is set out in how it works.

Band
Themed suite
First draft
12 working days
Revisions
One round included
Review
Our legal team, before delivery
Format
Word (.docx) and PDF
Maintenance
$29 to $99 a month

What happens when a customer sends a security questionnaire?

A security questionnaire asks about controls, and the reviewer on the customer's side usually asks to see the written policy behind an answer. The set supplies that policy layer: the six documents listed under What you get, each with a control table. Name the questionnaire in the intake and send it once we reply, and the set is drafted so that each question has a clause to point at; the control table in each document then lists the questions that document answers.

A questionnaire may follow a standard format. The Cloud Security Alliance publishes the CAIQ, yes or no questions documenting the security controls of IaaS, PaaS and SaaS services, now at version 4.1 (Cloud Security Alliance, STAR Level 1: Security Questionnaire (CAIQ v4.1)).

Google published its Vendor Security Assessment Questionnaire (VSAQ) as open-source code, with templates for web applications, security and privacy programmes, infrastructure, and physical and data centre security; the repository was archived in November 2022 and the templates remain public (google/vsaq on GitHub, Vendor Security Assessment Questionnaire). A customer's own spreadsheet usually asks the same questions in its own order, and the control table finds a clause for each one.

Two parts stay with you. We do not write your answers to the questionnaire, and we do not supply evidence that the controls operate. Each answer should describe the controls your organisation actually runs and the evidence it actually holds, such as the last access review or the last restore test; each policy names the record that shows its control is followed, and keeping that record is your operation. The guide to which policies a SaaS startup needs first maps the questionnaire sections to the documents in more detail.

What we need from you

The intake asks what systems you run and where they are hosted, how staff and contractors get and lose access, which devices are allowed, how incidents are reported and who is on call, how backups are taken and tested, and which vendors hold your data. Name any existing policies, your last questionnaire and, if you have one, the auditor's control list, and send them once we reply.

How it is drafted and reviewed

We draft against the four themes of ISO/IEC 27001:2022 Annex A (A.5 organisational, A.6 people, A.7 physical, A.8 technological) and the security category of the AICPA 2017 Trust Services Criteria (revised points of focus, 2022) used in SOC 2 reports, principally CC6 on logical and physical access controls and CC7 on system operations. Each policy carries a control table in the sequence auditors expect.

Our legal team reviews the draft before it reaches you and records the review in the revision block. You mark changes, we revise once, and the set arrives in Word and PDF with a document ID on every page. The quote within $1,200 to $2,500 depends on the number of systems and the depth of the vendor policy; see pricing and how it works.

Drafted against

  • ISO/IEC 27001:2022 Annex A
  • AICPA 2017 Trust Services Criteria (revised points of focus, 2022), security
  • Your customer's security questionnaire, when you send it to us

What maintenance covers

When the rule changes, your document changes. Under the maintenance plan we track Annex A and the Trust Services Criteria you were drafted against, issue a revised set with the changes marked when either moves, and keep the control tables and revision history current. Without the plan, the set is still yours to use and to edit; it simply stops being tracked.

$29to $99a month, optional

Questions about the information security policy set

Will the information security policy set get us through a SOC 2 audit?
The information security policy set is the written policy layer a SOC 2 auditor asks to see, structured the way auditors expect to read it. A SOC 2 examination also tests whether the controls those policies describe are in place and operating; that part is your operation, not the document. The set can answer customer security questionnaires before any audit is scheduled.
Can technical standards, such as a password standard, be added to the information security policy set?
The six documents in the information security policy set state each control, its owner and its record. A technical standard, such as a password or encryption standard, can be added: ask for it in the intake and it goes into the fixed quote.
Can the information security policy set be mapped to our customer's questionnaire?
The information security policy set can be mapped to your customer's security questionnaire. Name the questionnaire in the intake, send it once we reply, and the set is drafted so that each question has a clause to point at. The control table in each document lists the questions it answers.
Does the information security policy set answer a CAIQ or VSAQ questionnaire?
The information security policy set does not answer a CAIQ, a VSAQ or any other questionnaire for you. The answers are yours, and they describe the controls your organisation actually runs and the evidence it actually holds. What the set supplies is the written policy behind them: name the questionnaire in the intake, send it once we reply, and the set is drafted so that each question has a clause to point at, with the control table in each document listing the questions it answers.
How long does an information security policy set take?
The first draft of an information security policy set takes twelve working days from a complete intake. Your review and the one revision round included add whatever time you need.

Guides that go deeper