Exercise
Build Your First Asset Inventory
Practice building an inventory from a realistic ten-person business, then apply the same pattern to your own.
Beginner
20 min
Free
CIS Controls
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Template
Information Security Policy
The parent policy that states what your organization protects, who is responsible, and how the rest of your documentation hangs together.
- Intended audience
- Owners and program leads
- Difficulty
- Intermediate
- Estimated time
- 45 minutes
- Access
- Free
NIST CSF
NIST SP 800-171
ISO 27001
All industries
Version v1.0.0 · Last reviewed 2026-08-01 · Document owner: ComplianceAnvil Content Team
What you will be able to do
- Identify the scope statement your policy needs and what should be explicitly excluded.
- Assign the three role categories (owner, managers, everyone) to real people in your organization.
- Write policy statements that are specific enough to be enforced, not just aspirational.
- Set an exception process that is time-limited and requires approval.
- Schedule the annual review cycle before the policy is distributed.
1. Purpose
State why the policy exists and what outcome it protects.
2. Scope
- Systems, applications, and cloud services covered.
- People covered: employees, contractors, and third parties.
- Data types covered, and anything explicitly out of scope.
3. Roles and responsibilities
- Program owner: approves policy and accepts risk.
- Managers: enforce the policy within their teams.
- Everyone: follows the policy and reports issues.
4. Policy statements
- Access is granted on a least-privilege basis and reviewed periodically.
- Multi-factor authentication is required on all accounts that support it.
- Company data is stored only in approved systems.
- Security incidents are reported immediately.
- Security awareness training is completed annually.
5. Exceptions
Describe how an exception is requested, approved, and time-limited.
6. Enforcement
State the consequences of non-compliance in plain language.
7. Review
Owner, approval date, version, and next review date.
Key takeaways
- An information security policy only works if it names an owner who can approve exceptions and accept risk.
- Scope should state both what is covered and what is explicitly out of scope, so readers are not left guessing.
- Policy statements need to be specific and testable, such as requiring MFA, rather than vague commitments to 'be secure.'
- An exception process with an expiration date prevents one-time waivers from becoming permanent, undocumented gaps.
- A policy without a review date will drift out of date silently; the review section should be filled in before distribution.
Sources
Written from these public, authoritative publications. ComplianceAnvil paraphrases and summarizes them; it does not reproduce copyrighted control text.
NIST · 2.0
Cybersecurity Framework (CSF) 2.0(opens in a new tab)Link last confirmed 2026-02-01
NIST · Revision 3
SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems(opens in a new tab)Link last confirmed 2026-02-01
CISA
Cross-Sector Cybersecurity Performance Goals(opens in a new tab)Link last confirmed 2026-02-01
How this was written and reviewed
Published
- Author
- ComplianceAnvil Editorial Team
- Technical reviewer
- ComplianceAnvil Technical Review Board
- Jurisdiction
- United States (federal)
- First published
- 2026-08-01
- Last reviewed
- 2026-08-01
- Next review due
- 2027-08-01
Version v1.0.0 · Document owner: ComplianceAnvil Content Team
Important
This template is provided for readiness and educational purposes. Organizations should review and adapt it for their environment.
Related resources
Matched on shared frameworks, topics, and program packs.
Guide
Building a Security Program from Scratch
A ninety-day sequence for a business with nothing written down yet — cheapest, highest-impact work first.
Beginner
14 min
Free
NIST CSF
CIS Controls
Published · v1.0.0 · 2026-08-01
Exercise
Classify Sample Data
Sort realistic records into classification levels and defend the handling rules that follow.
Intermediate
15 min
Free
NIST SP 800-171
ISO 27001
Published · v1.0.0 · 2026-08-01
Guide
Common Compliance Mistakes
The recurring, expensive errors we see small businesses make — and the cheap correction for each.
Beginner
9 min
Free
NIST CSF
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Exercise
Complete a Readiness Scorecard
Score yourself honestly across six areas and turn the two lowest into a short plan.
Beginner
15 min
Free
NIST CSF
Published · v1.0.0 · 2026-08-01
Quick reference
Compliance Acronyms — One Page
The acronyms that appear in contracts and assessments, defined in one line each.
Beginner
5 min
Free
CMMC
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Put this into practice
Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.