Compliance policy templates (125)
Every editable policy and procedure across the ComplianceDocs catalog — Microsoft Word (.docx) and Excel (.xlsx), aligned to ISO 27001, SOC 2, HIPAA, NIST CSF 2.0, GDPR and AI governance. Choose a template to see which toolkits include it.
This page lists every policy and procedure template in the catalog, from A to Z. Each one is an editable Word or Excel file you download and own. The documents are drawn from our framework toolkits, so a single template often appears in more than one toolkit. Select any title to see which toolkits include it and what it covers.
The templates are built for small and growing organizations. That includes startups answering their first enterprise security questionnaire, SaaS companies and MSPs pursuing ISO 27001 or SOC 2, medical and dental practices documenting HIPAA, and tax firms meeting the FTC Safeguards Rule. You do not need a consultant or a full-time compliance hire to begin. You need a structured, professionally written draft you can tailor to how your organization actually works.
How to use a policy template
Using a template follows a simple path. First, download the file and open it in Word or Excel. Google Docs and LibreOffice work too. Next, replace the amber [bracketed placeholders] with your real details — your company name, roles, systems, and review dates. Then adapt the wording to your actual practice. A policy has to describe what you really do, not an ideal you do not follow. Finally, have the right owner review and approve it, then put it into use. Most documents take under an hour to tailor.
How the templates map to frameworks
Each policy is aligned to the requirements of its framework. ISO 27001 policies map to the Annex A controls and the clauses of ISO/IEC 27001:2022. SOC 2 policies map to the AICPA Trust Services Criteria. HIPAA policies cover the Security Rule and the Privacy Rule. GDPR documents follow the relevant articles, including Records of Processing Activities under Article 30. NIST CSF 2.0 documents map to the six Functions — Govern, Identify, Protect, Detect, Respond, and Recover. Many controls overlap across frameworks, so one well-written policy often supports more than one program. The number next to each template shows how many toolkits include it.
What a template can and cannot do
Be clear about the honest limit. A template is the documentation layer of a compliance program. It removes the slowest part of getting ready, which is drafting from a blank page. It does not, by itself, make your organization compliant, certified, or attested. ISO 27001 certification comes from an accredited certification body. A SOC 2 report comes only from a licensed CPA firm. HIPAA and GDPR compliance come from operating the controls day to day. The documents give you the structure auditors expect; running the program is the work that earns the result.
Every template is sold under a single-organization license as a one-time purchase. You can edit the documents freely for your own organization. If you are a consultant or an MSP planning to reuse them across multiple clients, contact us first so we can arrange fair multi-client terms. To browse by framework instead of by document, see the full toolkits, read a framework overview in our guides, or look up an unfamiliar term in the compliance glossary.
Common questions
- Do I need every policy on this page?
- No. You only need the policies that match the framework you are working toward and the way your organization operates. Each toolkit bundles the documents that framework expects, so it is easier to start from the toolkit for your framework than to pick documents one by one. Within a toolkit, you tailor or remove what does not apply.
- Are these templates kept up to date?
- Yes. We write each document to the current version of its framework, such as ISO/IEC 27001:2022, and revise the documents when a standard changes materially. If a framework you bought is updated in a way that affects your documents, you can re-download the current version.
- Can I edit the documents?
- Yes, fully. Every file is an editable Word or Excel document, not a locked PDF. You change the wording, add sections, and brand it as your own. That is the point — a policy has to describe your real practice, so editing is expected.
- Will these pass an audit on their own?
- No document passes an audit just by existing. An auditor checks whether your controls actually operate, and whether your policies match what you really do. The templates give you a strong, framework-aligned starting point and the structure auditors expect. You still operate the program and produce the evidence.
- Acceptable Use Policy (9)
- Access Control Policy (12)
- Adverse Event Analysis Procedure (2)
- AI Acceptable Use Policy (13)
- AI Data Governance and Privacy Policy (3)
- AI Governance Policy (3)
- AI Incident and Model Failure Response Procedure (3)
- AI Incident Response and Concern Procedure (2)
- AI Management System Policy (2)
- AI Objectives and Continual Improvement Procedure (2)
- AI Risk Assessment and Treatment Procedure (2)
- AI Risk Assessment Procedure (3)
- AI Roles, Responsibilities and Resources (2)
- AI System Impact Assessment Procedure (2)
- AI System Inventory and Classification Standard (3)
- AI System Inventory and Documentation Standard (2)
- AI System Life Cycle Management Policy (2)
- AI Transparency and Disclosure Standard (3)
- AI Transparency and Interested-Party Information Standard (2)
- AI Vendor and Tool Assessment Procedure (3)
- AIMS Internal Audit Procedure (2)
- AIMS Management Review Procedure (2)
- Asset Management and Information Classification Policy (8)
- Asset Management Policy (2)
- Audit Controls and Activity Review Policy (4)
- Authentication and Password Policy (4)
- Availability and Capacity Management Policy (3)
- Backup and Recovery Policy (8)
- Breach Notification Procedure (4)
- Business Associate Management Policy (4)
- Business Continuity and Disaster Recovery Plan (5)
- Business Continuity and ICT Readiness Plan (8)
- Change Management Policy (5)
- Change Management Procedure (3)
- Client Confidentiality and Information Barriers Policy (2)
- Client Environment Access and Credential Management Policy (2)
- Client Records Retention and Disposal Policy (2)
- Code of Conduct and Ethics Policy (3)
- Communication and Information Policy (3)
- Consent Management Policy (2)
- Contingency and Disaster Recovery Plan (4)
- Continuous Monitoring Policy (2)
- Cookies and Tracking Policy (2)
- Cryptographic Controls Policy (3)
- Customer Data Isolation and Multi-Tenancy Security Policy (2)
- Customer Privacy Notice (3)
- Cyber Risk Management Strategy and Procedure (2)
- Cybersecurity Governance Policy (2)
- Cybersecurity Improvement Procedure (2)
- Cybersecurity Roles and Responsibilities (2)
- Cybersecurity Supply Chain Risk Management Policy (2)
- Data Classification and Handling Policy (5)
- Data Incident Response Plan (2)
- Data Management for AI Systems Policy (2)
- Data Protection Impact Assessment Procedure (2)
- Data Protection Policy (2)
- Data Retention and Deletion Policy (2)
- Data Retention and Disposal Policy (5)
- Data Retention and Secure Disposal Policy (3)
- Data Security Policy (2)
- Data Subject Rights Request Procedure (2)
- Device and Media Control Policy (4)
- DPO Designation Assessment and Privacy Roles (2)
- Employee Privacy Notice (2)
- Encryption and Key Management Policy (5)
- Encryption and Transmission Security Policy (4)
- ePHI Access Control Policy (4)
- EU AI Act Readiness Checklist (3)
- Facility Security Plan (4)
- Governance and Organizational Structure Policy (3)
- HIPAA Privacy Rule Compliance Policy (5)
- HIPAA Security Management Policy (4)
- Human Oversight and Accountability Standard (3)
- Human Resources Security Policy (11)
- Identity and Access Management Policy (2)
- Incident Recovery Plan (2)
- Incident Response Plan (2)
- Information Security Incident Response Procedure (9)
- Information Security Policy (12)
- Information Security Roles and Responsibilities (8)
- International Data Transfer Policy (2)
- ISMS Internal Audit Procedure (3)
- ISO 27001 to SOC 2 Control Crosswalk Guide (1)
- Lawful Basis Assessment Guide (2)
- Logging and Monitoring Policy (8)
- Management Review Procedure (3)
- Monitoring and Logging Policy (5)
- Network and Endpoint Security Policy (3)
- Office Data Security Policy (2)
- Payment Card Data Security Policy (2)
- Personal Data Breach Response Procedure (2)
- Physical and Environmental Security Policy (8)
- Physical Security Policy (3)
- Platform and Application Security Policy (2)
- Privacy and PII Protection Policy (3)
- Processor and Vendor Management Policy (2)
- PTIN Renewal and W-12 Data Security Checklist (2)
- Records of Processing Activities Standard (2)
- Remote Work and Seasonal Staff Security Policy (2)
- Remote Working and Mobile Device Policy (8)
- Responsible Use of AI Policy (2)
- Risk Assessment and Treatment Procedure (8)
- Risk Assessment Procedure (5)
- Sanction Policy (4)
- Secure Development Policy (3)
- Secure Software Development Policy (3)
- Security Awareness and Training Policy (5)
- Security Awareness and Training Procedure (9)
- Security Awareness and Training Program (4)
- Security Awareness Training Program (2)
- Security Incident Response Plan (6)
- Security Incident Response Procedure (4)
- Security Official Designation and Responsibilities (4)
- Service Provider Oversight Policy (2)
- Supplier and Cloud Services Security Policy (8)
- Technology Infrastructure Resilience Policy (2)
- Third-Party AI Supplier and Customer Policy (2)
- Vendor and Business Partner Management Policy (5)
- Vulnerability and Patch Management Procedure (3)
- Vulnerability Management Procedure (5)
- WISP Annual Review and Update Procedure (2)
- Workforce Security and Access Authorization Policy (4)
- Workforce Termination and Offboarding Procedure (4)
- Workstation Use and Security Policy (4)
- Written Information Security Plan (WISP) (2)