Information security policy
Company policy template, built out as an information security policy
A company policy template needs a document control block, a purpose and scope, numbered rules people can be held to, a table of who does what, and the consequences of a breach. This example shows that structure filled in as one complete policy: Talbot & Vance, a professional services firm, publishes its information security policy as version 3.1, owned and approved by the Chief Operating Officer and due for review in August 2027. Twelve numbered clauses run from acceptable use to compliance across 15 pages, with a four level classification table, a 30 minute incident reporting rule and a responsibilities table by role.
The document, page by page
Every page as it renders and as it prints, with nothing summarised. Read the wording before you reuse it.
Section by section
What each section is for, so you can keep the ones you need and drop the rest.
- Document control and introduction
- Version, owner, approver, dates and classification, then purpose and scope covering staff, contractors and third parties.
- Acceptable use
- Six prohibited uses, the limits on incidental personal use, and a ban on unapproved software.
- Access control and passwords
- Least privilege, one account per person, 14 character passwords and how access is granted and removed.
- Multi factor authentication
- Where MFA is mandatory, the three approved methods and the duty to report a lost token.
- Device and endpoint security
- Anti malware, full disk encryption, a 15 minute screen lock, device management and the BYOD consent.
- Email and phishing
- Monitoring, five signs of a phishing email, how to report one and a ban on automatic forwarding.
- Data classification and handling
- Four levels from Public to Restricted with examples, storage rules and sharing rules in one table.
- Remote working and third party access
- Secure home setups, mandatory VPN, supplier due diligence, contract clauses and access reviews.
- Incident reporting and breach notification
- The 30 minute reporting rule, what counts as an incident, and the assessment and OAIC notification process under the NDB scheme.
- Roles, compliance and related documents
- Duties for staff, managers, IT, data owners and the COO, the consequences of a breach, and five related policies.
The parts every company policy shares
Whatever the subject, a company policy has the same skeleton, and this example shows each part in place. Document control records the version, owner, approver, approval date, next review and classification. A purpose paragraph says why the policy exists and a scope paragraph says who it binds, here employees, contractors, consultants and any third party with system access. Numbered clauses carry the rules, each specific enough to test: 14 character passwords, a screen lock after 15 minutes, incidents reported within 30 minutes, privileged supplier access reviewed quarterly. A roles table gives each duty an owner. A compliance clause says what happens when the policy is broken, and a related documents list points to the policies that sit beside it, so the same rule is not written twice.
Using this as a template for other policies
Keep the document control block, the purpose and scope paragraphs, the roles table and the compliance clause exactly as they are, and replace the numbered clauses with the rules for your subject. A leave policy swaps passwords and devices for notice periods, evidence and how leave is approved. A remote work policy keeps the home security and VPN clauses from this one and adds office days, equipment and safety at home. Separate finished examples of a leave policy, a remote work policy and a code of conduct show those subjects written out in full. Whatever the subject, set the review date when the policy is approved rather than leaving it blank, and give every rule a number so a warning letter or an audit finding can cite it.
What to check before adopting this policy
The breach notification clause follows the Notifiable Data Breaches scheme in the Privacy Act 1988, which applies to most organisations with turnover above $3 million and to some smaller ones, such as health service providers. Under that scheme a suspected eligible breach must be assessed within 30 days, and the OAIC and affected individuals are told as soon as practicable once it is confirmed. Keep the classification labels consistent: the table uses four levels from Public to Restricted, and the email and supplier clauses use the same labels, because a label that appears only once is the kind of gap an auditor notes. Replace the example tools named in brackets with the systems you actually run.
What makes this document work
Document control comes before anything else
Version, owner, approver, approval date, next review and classification sit in one block before the purpose statement. That is what makes the policy auditable: anyone can tell which version applied on a given date and when it is next due for review.
It can be navigated
A contents page and numbered clauses, because a 15 page policy nobody can find their way around is a policy nobody follows. A manager handling an incident can go straight to clause 9 without reading the acceptable use rules first.
Rules are specific
Passwords need 14 characters, screens lock after 15 minutes, incidents are reported within 30 minutes and privileged third party access is reviewed quarterly. Each one is a clause somebody can be held to.
Questions people ask
What should an information security policy cover?
Acceptable use, access control and passwords, multi factor authentication, devices, email and phishing, data classification, remote work, supplier access, incident reporting and breach notification, then roles and consequences. This example gives each its own numbered clause, so a rule can be cited by number in training, in an audit or in a disciplinary letter.
Who should approve a company policy?
An accountable executive with authority over the area it governs, recorded on the document itself with the approval date and the next review date. Here the Chief Operating Officer is both owner and approver. In a larger organisation the owner is often a manager who maintains the policy and the approver a board or executive committee that signs it off.
How often should a security policy be reviewed?
At least once a year, and again after a significant incident, a new system or a change in the law. This example was approved on 5 August 2026 with the next review set for August 2027. Write the review date into the document control block, because a policy with no review date quietly becomes one nobody owns.
Does a security policy need a data classification scheme?
Yes. Without one, handling rules have nothing to attach to, and staff guess whether a spreadsheet can go by email. This example uses four levels, Public, Internal, Confidential and Restricted, each with examples, storage rules and sharing rules in one table. Four levels is enough for most firms; more than that and people stop telling them apart.
What is the document control block at the top for?
It carries the version, the owner, the approval date and the review date. This policy opens with it, before the introduction. Without those four facts nobody can tell whether they are reading the current policy, and an auditor asking which version applied on a given date has no way to answer.
Why does the policy list related documents?
Because a policy is one of a set, and a reader who needs the acceptable use rules should not be guessing. This one closes with the related documents alongside roles and compliance. It also stops the same rule being written twice in two policies that then drift apart at different review dates.
Build your own in about a minute
The button below opens the generator with this use case already described. Change the wording to match your own, generate, then edit anything you like.
Make one like thisOther document examples
Code of conduct template with a do and do not list for each standard
A code of conduct is read once at induction and again when something goes wrong, and it has to work both times. This one keeps eight standards, gives each a short list of what to do and what not to do, sets the gift threshold and the conflict declaration as numbers and tables, and ends with how to raise a concern and what follows a breach.
Board meeting minutes template with actions and owners
Minutes of the 14 August 2026 board meeting of Fernbrook Community Housing Ltd, a six director board with one apology. Seven items run from confirming the June minutes to a confidential CEO succession discussion, each closing with a resolution on its own line, and six actions with an owner and a due date are collected in one table before the meeting closes at 11:45am.
Privacy policy template written to the Australian Privacy Principles
A privacy policy is a list of true statements about what a business does with information, and copying a US template produces a list of false ones. This policy is written for an Australian online store to the thirteen privacy principles, with a table of every service that receives customer data and where it is, which is the part most policies skip.
Want the steps in the builder? Read Create a document with AI, then Lay out a document exactly how you want it. For everything this generator can do, see the document maker.
Written and checked by the OneCraft team. Last checked .