Policy Templates Library
12 SME-sized policy templates with clause-level traceability to NIS2, DORA, GDPR, ISO 27001, NIST CSF 2.0 and CRA.
Information Security Policy
Incident Response Policy
Business Continuity & ICT Disaster Recovery
Access Control & Identity Management
Cryptography & Key Management
Third-Party / ICT Supplier Risk Management
Vulnerability & Patch Management
Logging & Monitoring
Acceptable Use
Backup & Restoration
Security Awareness & Training
Data Protection & Breach Notification
How to use the policy templates
- Filter by framework (for example NIS2 Art. 21 or ISO 27001:2022) to see the templates that map to it.
- Open a template to read it with its trace IDs; the side panel lists every control it satisfies.
- Click Customize to edit the Markdown in your browser and fill the
{{ORG}}-style placeholders. - Export as Markdown, Word-friendly HTML, or a per-policy traceability sheet in Excel. The button above exports the matrix for all policies at once.
- Have the policy approved by the body named in the header table, publish it to staff, and review it on the stated cycle.
Frequently asked questions
Which security policies does a small company need for NIS2?
NIS2 Article 21 lists the measures, not document names, but most SMEs cover them with an information security policy plus policies for incident handling, business continuity and backup, supplier security, access control, cryptography, vulnerability handling, logging and awareness training. Use the NIS2 filter above to see which templates map to Article 21. To check where you stand, try the NIS2 self-assessment.
Are these policy templates enough for ISO 27001 certification?
No template makes you certifiable on its own. ISO 27001 auditors check that policies are approved, communicated and actually applied, and that they match your risk assessment and Statement of Applicability. The templates give you a traceable first draft; the SoA builder helps with the next step.
What are the {{ORG}} and {{OWNER_ROLE}} placeholders?
Fields you must fill in before approval: organisation name, document owner, approving body, effective date and next review date. Replace them in Customize or in your own editor after export. Each template also suggests an owner role and a review cycle, usually 12 months.
What does clause-level traceability mean?
Each clause carries the control IDs it helps satisfy, for example nis2_art21:21_2_g or iso_27001_2022:A.5.10. The detail page lists them and links each one to the framework crosswalk, and the Excel matrix gives auditors the full policy-to-control mapping.
Where are my customised policies saved?
Only in your browser on this device. Nothing is uploaded, so export the Markdown or Word-friendly HTML once you are done, and store the approved version in your own document system.