Free tool

Policy Generator

Answer a short form and download the four starter policies as Word files with your company, owners, dates, systems and commitments already filled in.

Information Security, Acceptable Use, Access Control, Incident Response · .docx in a .zip · Nothing stored

1. Company and approval

Company legal name Policy owner (name, role) Approved by (name, role) Approval date Effective date Next review date Security contact email Incident reporting channel Incident Commander (name, role)

2. Systems

Collaboration suite Approved file sharing Access request / ticketing system

3. Numbers you will actually keep

Defaults are what we see pass audits at companies of 20 to 300 people. Change them only to what you will operate; every number here is testable.

Screen lock after (minutes) Minimum password length Lockout after failed attempts Leaver access removed within (hours) Review removals done within (business days) Service account credential rotation Log retention (months) Critical vulnerability fix (days) High vulnerability fix (days) Medium vulnerability fix (days) Risk register review Critical incident acknowledged within (hours) Incident Commander assigned within (hours) Post-incident review within (business days) Customer breach notification within (hours)

4. Policies to generate Information Security Policy Acceptable Use Policy Access Control Policy Incident Response Policy

The documents are built on our server from your inputs and returned as a .zip; nothing is stored. Leave a field blank to keep a [bracketed] placeholder in the document.

What you get

The same four policies as the starter pack, with the company name, owner, approver, dates, contacts, systems and every numeric commitment filled in from the form, as separate Word files in a .zip. Each file keeps its numbered statements, procedures and records list, framework reference table and revision history. Anything you left blank stays as a [bracketed] placeholder so you can find it.

Before you publish them

Read every statement once as the person who has to operate it. A policy that promises quarterly access reviews you do not run is a finding, not a control.
Have the approver actually approve: a meeting minute, an e-signature or a ticket. The approval row in the metadata table is the first thing an auditor checks.
Publish where staff can find the files and collect acknowledgements; put the review date in your compliance calendar.
Four policies are the core. The remaining eight to twelve (change management, vendor management, business continuity, data classification, secure development, logging, vulnerability management, HR security, asset management, cryptography) we write during readiness engagements.

Do you keep what I enter?

No. The inputs go to our server, the documents are built in memory and returned, and nothing is written to disk or logs except a count. The form remembers your entries in your own browser so you can regenerate later.

Can I change the wording?

They are ordinary Word documents; edit freely. Keep the statement numbering if you have already referenced it elsewhere.

Are these enough for ISO 27001?

They cover Clause 5.2 and the Annex A policy controls they map to (listed in each file). The ISMS itself needs the scope, risk method, Statement of Applicability and the remaining topic policies; the SoA builder shows which.

Stuck on a step? Ask us.

Book a free 30-minute consultation. Bring what you have so far and we will tell you what we would do next.

Book a free consultation

Ask about pricing