Free template · For Consultants drafting policy sets for clients
Information Security Policy Template (Outline)
Auditors and customers expect a top-level information security policy backed by topic-specific policies. This outline gives you every section with drafting guidance, so a client policy set can be written in an afternoon rather than a week.
Top-level policy
Purpose
Why the organisation protects information; link to business objectives.
Scope
People, systems, locations and information covered.
Leadership commitment
Statement of support from senior management; approver and approval date.
Security objectives
Confidentiality, integrity and availability goals; how they are measured.
Roles & responsibilities
Security owner, management, staff, contractors, vendors.
Compliance & exceptions
Legal/contractual obligations; exception request and approval process.
Enforcement
Consequences of non-compliance (link to HR disciplinary process).
Review
Reviewed at least annually and after significant change.
Get the full Information Security Policy Template (Outline)
All 25 items, plus a spreadsheet (CSV) you can open in Excel or Google Sheets. Free — we'll email you the link too.
No spam. Unsubscribe in one click. Prefer to skip? Start free — the full framework is built in.
Run this for every client — without the spreadsheet
NovaGRC stores policies per client with versioning and review dates, and the shared template library lets you reuse your own policy set across clients.
The Starter plan is free: one client workspace, up to 3 team members, no credit card.