Security Policy Draft
Drafts a security policy from the key decisions and requirements you supply. Use it when standing up a new policy or replacing an outdated one, before it goes to legal or leadership review.
ORGANIZATION NAME ·ORG TYPE ·EMPLOYEE COUNT ·AUTHOR ROLE ·POLICY SUBJECT ·REGULATORY DRIVERS ·RELATED POLICIES
## Context
You are a security policy writer helping [ORGANIZATION NAME], a [ORG TYPE] with approximately [EMPLOYEE COUNT] employees. The person directing this work is a [AUTHOR ROLE] responsible for information security governance. The policy will govern how the organization handles [POLICY SUBJECT]. Applicable regulatory or compliance drivers: [REGULATORY DRIVERS]. Any existing related policies or standards to stay consistent with: [RELATED POLICIES].
## Task
Draft a security policy with these sections: Purpose, Scope, Definitions, Policy Statements, Roles and Responsibilities, Compliance and Enforcement, Exceptions Process, and Review Cycle. Include a document header with: title, version number, effective date placeholder, owner, and approval authority.
## Standards
- Policy statements use "must" for mandatory requirements and "should" for recommendations. Avoid "shall" unless required by the regulatory driver.
- Scope states explicitly who and what systems are covered, and who and what are out of scope.
- Definitions cover every term a new employee would not know; no undefined acronyms.
- Roles and Responsibilities name job functions, not individuals.
- Compliance section states the consequence of non-compliance at a category level (disciplinary action, contract termination, regulatory referral); it does not invent penalty amounts.
- Exceptions Process names the approver, the required documentation, and the review interval.
- Do not fabricate regulatory citations, control numbers, or penalty figures. If a regulatory driver implies a specific control, reference the driver by name and instruct the reader to consult the authoritative source.
- If any input is missing or ambiguous, ask before drafting rather than filling the gap with invented requirements.
## Standards (continued)
- Plain language throughout. No legal jargon a non-lawyer cannot parse.
- Target length: 600 to 1,000 words for the policy body, excluding the header and definitions table.BEFORE YOU RUN IT
- Confirm the policy subject, scope boundary, and the regulatory or business driver requiring it
- Gather any existing related policies, standards, or procedures so the new policy stays consistent
- Identify the approval authority and document owner before drafting, since these belong in the header
- Confirm all technical requirements (control mandates, system names, compliance references) come from your own program documentation, not from the AI
- Redact any sensitive details such as system credentials, network addresses, personnel data, or anything your organization classifies before pasting into the prompt
- Note the target audience (all staff, IT only, third-party vendors) so scope and language level are calibrated correctly
VERIFY BEFORE IT LEAVES YOUR HANDS
- Every regulatory citation or control number cross-checked against the authoritative source (NIST SP 800-53, CIS Controls, ISO 27001, HIPAA, etc.) before the policy is published
- Policy statements reviewed by legal or HR before distribution, since enforcement language has employment and contractual implications
- Scope confirmed with system owners to ensure no critical assets or personnel are accidentally excluded
- Exceptions Process reviewed by the named approver to confirm they accept the responsibility
- No penalty amounts or disciplinary actions invented by the AI; all consequence language reviewed against your HR policies
- Definitions table checked against your organization's existing glossary for consistency
- Version number, effective date, and approval authority filled in by a human before the policy is signed
Sample output
Sample output. Generated by AI from sample inputs:
INFORMATION SECURITY POLICY: ACCEPTABLE USE OF CLOUD SERVICES
Version: 1.0 | Effective Date: [PENDING APPROVAL] | Owner: Information Security Manager | Approval Authority: VP of Technology
Organization: Northwind Industrial Supply | Classification: Internal
Purpose
This policy establishes requirements for the use of cloud-based services to protect Northwind Industrial Supply's data, systems, and reputation. It ensures cloud adoption is secure, compliant, and consistent with contractual obligations.
Scope
This policy applies to all Northwind employees, contractors, and third-party vendors who access or store Northwind data in cloud services. It covers all cloud platforms including software-as-a-service (SaaS), infrastructure-as-a-service (IaaS), and platform-as-a-service (PaaS) solutions. It does not apply to on-premises systems or tools that do not transmit or store Northwind data.
Definitions
Cloud service: Any computing resource delivered over the internet by a third-party provider, including storage, applications, and computing platforms.
SaaS (Software as a Service): Software hosted and delivered by a vendor, accessed via a web browser or API.
Data classification: Northwind's four-tier system (Public, Internal, Confidential, Restricted) governing handling requirements.
Policy Statements
1. Employees must obtain approval from the Information Security team before subscribing to or piloting any new cloud service that will store or process Internal, Confidential, or Restricted data.
2. Cloud vendors storing Confidential or Restricted data must execute a data processing agreement (DPA) with Northwind before data is transferred.
3. Employees must use Northwind-approved identity and access management credentials (single sign-on where available) for all cloud services. Personal accounts must not be used for business data.
4. Multi-factor authentication (MFA) must be enabled for all cloud services that support it, for all Northwind accounts.
5. Employees should review access permissions for cloud-shared files quarterly and remove access that is no longer needed.
Roles and Responsibilities
Information Security Manager: Maintains the approved cloud vendor list, reviews new service requests, and updates this policy annually.
IT Operations: Configures and enforces MFA for cloud services and maintains identity federation.
All Employees: Follow this policy, complete annual security awareness training that covers cloud use, and report suspected violations to the IT Help Desk.
Vendor Management: Ensures DPAs are executed before cloud vendor onboarding.
Compliance and Enforcement
Violations of this policy may result in disciplinary action up to and including termination, in accordance with Northwind's Employee Code of Conduct. Vendors in violation may have their access revoked and contracts reviewed. Suspected violations should be reported to the Information Security Manager.
Exceptions Process
Requests to deviate from this policy must be submitted in writing to the Information Security Manager. Requests must include: the business justification, the specific policy statement to be excepted, the compensating controls in place, and the proposed exception duration (maximum 12 months). Approved exceptions are logged and reviewed at renewal.
Review Cycle
This policy will be reviewed annually or following any material change to Northwind's cloud environment or applicable regulatory requirements.
Note: This is a draft for review. Regulatory references and penalty language must be confirmed against Northwind's specific compliance obligations before approval. CUSTOMIZATION
Adjust the policy statement count and specificity to match your organization's risk tolerance and maturity level. A startup with 20 employees needs simpler, broader policy statements than a 5,000-person regulated entity. If a specific framework drives the policy (CMMC, HIPAA, PCI DSS), add the control number as a reference in the relevant policy statement so auditors can trace coverage. For organizations with a formal policy template, paste the template structure into [RELATED POLICIES] so the AI matches your existing format.