Information Security Policy Template
Draft an internal information security policy based on the controls you actually use, such as MFA, backups, encryption and training.
Runs in your browser. Your input is processed on your device and is not uploaded to our server.
Only what you enter is stated as fact. Anything left blank stays out of the draft, or appears as a marked gap for you to fill in.
Lines starting with # are headings, “- ” are bullets and “> ” is the draft notice. Delete the notice only once the document has been reviewed.
You have edited this draft, so changes to the form no longer update it.
How to use the Information Security Policy Template
- Answer the questions. You only see those that matter for this document, and answers carry over to the other generators.
- Read the draft as it updates, fill in the gaps marked in yellow, and edit the text if you need to.
- Copy it, print it, or download it as TXT, HTML or PDF, and have it reviewed before you use it.
A policy that matches reality
Customers and auditors often ask for a security policy. This draft is built only from the rules you select, because a policy describing controls you do not have is worse than none. It is a starting point for small organisations, and it is not a full security programme or a certification such as ISO 27001.
How this draft is made
Only what you tell the tool is stated as fact, and anything you leave blank appears as a marked gap or is left out. Your answers stay in your browser and are not sent to our server.
This is a draft, not legal advice. Review it against the laws that apply to you and what you actually do, ideally with a qualified lawyer.