Security
Information Security Policy
Top-level information security policy for Your Organization — the parent ISMS document that sets objectives, authority, and the broad control framework under which all other security policies live.
Resources · Policy templates
A free starting point for every core policy
29 auditor-recognizable policy templates — the exact catalog CMDash ships in-product — free to read online, download, or open directly in CMDash where your organization name and effective date are filled in for you.
HR
Acceptable Use Policy
Defines acceptable and prohibited use of Your Organization information systems, devices, network resources, and communication tools by workforce members.
Security · ISO/IEC 27001:2022, FedRAMP Moderate
Access Control Policy
Defines how Your Organization grants, reviews, and revokes access to information systems — codifying least privilege, RBAC, privileged account rules, and quarterly access review cadence.
Security · ISO/IEC 27001:2022, FedRAMP Moderate
Password and Authentication Policy
Establishes Your Organization requirements for passwords, multi-factor authentication, credential rotation, and authentication of human and service accounts.
Privacy
Data Classification Policy
Establishes the data classification scheme used at Your Organization — Public, Internal, Confidential, Restricted — and defines handling, storage, and transmission rules for each level.
Compliance · ISO/IEC 27001:2022
Data Retention and Disposal Policy
Establishes retention schedules per data type and the secure disposal requirements that Your Organization follows to meet legal, regulatory, and contractual retention obligations while minimizing risk from over-retention.
Incident Response · FedRAMP Moderate, ISO/IEC 27001:2022
Incident Response Plan
Establishes Your Organization's process for detecting, responding to, and recovering from information security incidents — with severity matrix, roles, and playbook outline.
Business Continuity & DR · FedRAMP Moderate, ISO/IEC 27001:2022, SOC 2 Type II
Business Continuity and Disaster Recovery Policy
Defines Your Organization's approach to continuing critical business operations and recovering information systems following a disruption — with RTO/RPO targets, DR testing, and plan review cadence.
Business Continuity & DR · FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0
Business Continuity Plan
The operational plan Your Organization activates to keep critical business processes running through a disruption — priorities driven by the Business Impact Analysis, activation criteria, roles, communications, and the path back to normal operations.
Business Continuity & DR · FedRAMP Moderate, ISO/IEC 27001:2022, SOC 2 Type II, NIST Cybersecurity Framework 2.0
Disaster Recovery Plan
The technical recovery plan Your Organization follows to restore information systems and data after a disruption — recovery strategies by system tier, RTO/RPO commitments against the recovery register, runbook structure, and testing cadence.
Business Continuity & DR · FedRAMP Moderate, CMMC Level 2, SOC 2 Type II, NIST Cybersecurity Framework 2.0
Backup Policy
Defines how Your Organization backs up critical data and systems — the 3-2-1 rule, immutability, restore testing, and retention — so a backup is provably recoverable, not just present.
Operational
Change Management Policy
Defines how changes to Your Organization production systems are proposed, reviewed, approved, implemented, and documented — including CAB, change classifications, rollback, and emergency change handling.
Operational
Vendor Risk Management Policy
Establishes how Your Organization identifies, assesses, and monitors the information security risk introduced by third-party vendors — with tiering, SOC 2 review, and ongoing monitoring obligations.
Operational · CMMC Level 2
Configuration Management Policy
Defines how Your Organization establishes, hardens, and maintains secure baseline configurations for information systems — covering baselining, change control, least functionality, and unauthorized software prevention.
Operational · CMMC Level 2
Asset Management Policy
Establishes how Your Organization inventories, classifies, and tracks hardware, software, and data assets across their lifecycle — the foundation for applying every other security control consistently.
Security · CMMC Level 2
Media Protection Policy
Defines how Your Organization protects digital and physical media containing sensitive data — access, marking, transport, sanitization, and destruction requirements across the media lifecycle.
Security · CMMC Level 2
Physical Security and Environmental Protection Policy
Defines how Your Organization controls physical access to facilities and equipment housing information systems, and how it protects those systems from environmental hazards.
Security · CMMC Level 2
System and Communications Protection Policy
Defines how Your Organization protects the boundaries and internal segmentation of its networks and encrypts data in transit and at rest — boundary protection, network segmentation, and cryptography requirements.
Operational · CMMC Level 2
Maintenance Policy
Defines how Your Organization performs and controls system maintenance — including tool approval, remote maintenance safeguards, and personnel authorization — so maintenance activity does not become a security gap.
HR · CMMC Level 2
Security Awareness and Training Policy
Establishes Your Organization's security awareness and role-based training program — new-hire onboarding, annual refreshers, role-specific training, and insider-threat awareness.
HR · CMMC Level 2
Personnel Security Policy
Defines Your Organization's screening requirements before granting access to sensitive systems, and the security steps taken during role transfers and terminations.
Security · CMMC Level 2
Audit and Accountability Policy
Defines how Your Organization generates, protects, and reviews audit logs so that security-relevant events are traceable to an individual, detectable in a timely manner, and preserved for investigation.
Security · CMMC Level 2
Risk Assessment and Vulnerability Management Policy
Defines how Your Organization identifies and assesses information security risk, and how it discovers, prioritizes, and remediates vulnerabilities across its systems on a defined cadence.
Security · ISO/IEC 27001:2022, FedRAMP Moderate, SOC 2 Type II
Secure Development Lifecycle Policy
Sets the security requirements Your Organization applies from design through release and retirement of the software it builds, buys, or commissions: requirements, review, testing, environment separation, and dependency control.
Security · ISO/IEC 27001:2022, FedRAMP Moderate, CMMC Level 2, NIST SP 800-171 Revision 3
Cryptography and Key Management Policy
Defines when Your Organization must encrypt data in transit and at rest, which algorithms and protocols are acceptable, and how cryptographic keys and certificates are generated, stored, rotated, and retired.
Security · ISO/IEC 27001:2022, FedRAMP Moderate, CMMC Level 2, NIST SP 800-171 Revision 3
BYOD and Mobile Device Policy
Sets the conditions under which personal and mobile devices may access Your Organization data and systems: enrollment, minimum security settings, remote access, lost-device handling, and offboarding.
Privacy · ISO/IEC 27001:2022, GDPR, SOC 2 Type II
Privacy and Data Protection Policy
Sets how Your Organization collects, uses, shares, retains, and protects personal information: principles, lawful basis, individual rights, impact assessments, processors, and breach handling.
Security · ISO/IEC 42001:2023, NIST AI Risk Management Framework 1.0
AI Acceptable Use Policy
Sets the rules for how Your Organization workforce members use generative AI and other AI systems: approved tools, data that must not be entered, human review of output, intellectual property, and accountability.
Security · CMMC Level 2, FedRAMP Moderate, NIST SP 800-171 Revision 3
System and Information Integrity Policy
Covers the CMMC / NIST SP 800-171 System and Information Integrity family for Your Organization: flaw remediation, malicious code protection, security alerts and advisories, system monitoring, and detection of unauthorized use.
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.