Information Security Policy Set Template

A downloaded policy set is not a document. It is several hundred separate assertions about a company the template author never met, and every one of them is something an auditor, a customer or an insurer can hold you to. NIST says this plainly in its own control catalogue, where the discussion under AC-1 notes that simply restating controls does not constitute an organizational policy. Restating controls is exactly what a template pack does.

So the first pass here is arithmetic rather than editorial. Every modal sentence becomes a register row, quoted verbatim, and Calderhall's nineteen downloaded policies produced 437 of them against a room that had guessed somewhere between forty and eighty. Then each row is traced to the document that requires it: a statute, a clause in a signed customer contract, an answer given on the cyber insurance application, or a control in the framework actually being assessed. Two hundred and twelve had no such document.

Those 212 are not harmless. Forty-seven of them were already contradicted by the observable record, which makes them exceptions Calderhall wrote against itself. Ninety-day password rotation sat in the set while the identity provider had rotation switched off in 2024, following NIST's own advice that verifiers should not require memorized secrets to be changed arbitrarily. Deleting the sentence closed the finding. The SOC 2 narratives written afterwards had half as much to defend.