:root{--green:#2F7D43;--green-dark:#276B38;--green-light:#EAF3EC;--green-mid:#B5D9BD;--green-xlight:#F1F5F2;--accent:#2F7D43;--slate:#12201A;--blue:#176B87;--danger:#B42318;--text:#000;--text-2:#34423B;--border:#DCE3DF;--bg-light:#F6F8F7;}
.cfy-page *{box-sizing:border-box;}
.cbp{margin:0;font-family:"Outfit",sans-serif;color:#000;line-height:1.7;}
.cbp .wrap{max-width:820px;margin:0 auto;padding:0 24px;}
.cbp h1, .cbp h2, .cbp h3{font-family:"Outfit",sans-serif;font-weight:700;color:var(--slate);line-height:1.25;}
.cbp-hero{background:linear-gradient(170deg,#fff 55%,var(--green-xlight) 100%);padding:64px 0 44px;}
.cbp-cat{display:inline-block;font-size:11.5px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--green);background:var(--green-light);border:1px solid var(--green-mid);padding:5px 13px;border-radius:100px;margin-bottom:16px;text-decoration:none;}
.cbp-hero h1{font-size:38px;margin:0 0 14px;}
.cbp-meta{font-size:13.5px;color:var(--text-2);}
.cbp-body{padding:44px 0 20px;}
.cbp-answer{background:var(--bg-light);border-left:4px solid var(--green);border-radius:10px;padding:20px 24px;margin:0 0 30px;}
.cbp-answer strong{display:block;font-family:"Outfit",sans-serif;color:var(--slate);font-size:14px;margin-bottom:6px;text-transform:uppercase;letter-spacing:.05em;}
.cbp-answer p{margin:0;font-size:16.5px;color:#000;}
.cbp-toc{border:1px solid var(--border);border-radius:10px;padding:18px 24px;margin:0 0 32px;background:#fff;}
.cbp-toc h2{font-size:14px;margin:0 0 10px;text-transform:uppercase;letter-spacing:.05em;color:var(--text-2);}
.cbp-toc ol{margin:0;padding-left:20px;}
.cbp-toc li{font-size:14.5px;margin-bottom:5px;}
.cbp-toc a{color:var(--green);text-decoration:none;font-weight:600;}
.cbp-body h2{font-size:25px;margin:36px 0 12px;}
.cbp-body h3{font-size:18px;margin:26px 0 8px;}
.cbp-body p{font-size:16.5px;color:#111;margin:0 0 16px;}
.cbp-body ul, .cbp-body ol{margin:0 0 18px;padding-left:22px;}
.cbp-body li{font-size:16px;color:#111;margin-bottom:8px;}
.cbp-key{background:var(--green-xlight);border:1px solid var(--green-mid);border-radius:10px;padding:20px 24px;margin:28px 0;}
.cbp-key h3{margin:0 0 10px;font-size:15px;text-transform:uppercase;letter-spacing:.05em;color:var(--green-dark);}
.cbp-key ul{margin:0;padding-left:20px;}
.cbp-key li{font-size:15.5px;color:#111;}
.cbp-warn{background:#fef2f2;border-left:4px solid var(--danger);border-radius:10px;padding:18px 24px;margin:24px 0;}
.cbp-warn h3{color:var(--danger);font-size:15px;margin:0 0 8px;}
.cbp-warn li, .cbp-warn p{font-size:15.5px;color:#B42318;}
table.cbp-t{width:100%;border-collapse:collapse;margin:22px 0;font-size:15px;}
table.cbp-t th, table.cbp-t td{border:1px solid var(--border);padding:11px 14px;text-align:left;vertical-align:top;}
table.cbp-t th{background:var(--bg-light);font-weight:700;color:var(--slate);}
.cbp-faq{margin:38px 0 0;border-top:2px solid var(--border);padding-top:26px;}
.cbp-faq h2{margin-top:0;}
.cbp-q{border-bottom:1px solid var(--border);padding:16px 0;}
.cbp-q h3{margin:0 0 6px;font-size:16.5px;}
.cbp-q p{margin:0;font-size:15.5px;color:var(--text-2);}
.cbp-related{background:var(--bg-light);border-radius:12px;padding:24px;margin:34px 0 0;}
.cbp-related h2{font-size:17px;margin:0 0 12px;}
.cbp-related ul{margin:0;padding-left:20px;}
.cbp-related li{font-size:15.5px;margin-bottom:7px;}
.cbp-related a{color:var(--green);font-weight:600;text-decoration:none;}
.cbp-cta{background:var(--green);border-radius:14px;padding:34px;text-align:center;margin:38px 0 10px;}
.cbp-cta h2{color:#fff;font-size:23px;margin:0 0 8px;}
.cbp-cta p{color:#EAF3EC;font-size:15.5px;margin:0 0 18px;}
.cbp-btn{display:inline-block;background:#fff;color:var(--green-dark);font-weight:700;padding:13px 26px;border-radius:8px;text-decoration:none;font-size:15px;}
.cbp-btn:hover{background:var(--green-xlight);color:var(--green-dark);}
@media(max-width:760px){.cbp-hero h1{font-size:28px;}.cbp-body h2{font-size:21px;}table.cbp-t{font-size:13px;}}
{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Can we use policy templates?","acceptedAnswer":{"@type":"Answer","text":"As a starting structure, yes. They must then be rewritten to reflect your actual environment and practice."}},{"@type":"Question","name":"How long should a policy be?","acceptedAnswer":{"@type":"Answer","text":"Short enough to be read. Two to four pages is usually plenty for a startup."}},{"@type":"Question","name":"How often should they be reviewed?","acceptedAnswer":{"@type":"Answer","text":"At least annually, and whenever the practice they describe changes materially."}},{"@type":"Question","name":"Do staff need to sign them?","acceptedAnswer":{"@type":"Answer","text":"You need evidence of acknowledgement. Electronic acceptance with a date and name is standard."}}]}
GRC
How to write security policies people actually follow
Short answer
A policy is only useful if the behaviour it describes is what actually happens. Auditors test this by asking staff what they do and comparing it to the document. Downloaded templates fail that test because they describe an organisation you are not.
The policy set most frameworks expect
- Information security policy (the umbrella)
- Access control
- Acceptable use
- Incident response
- Business continuity and disaster recovery
- Change management
- Vendor and third-party management
- Data classification and retention
- Secure development
- Risk management
What makes a policy fail in practice
The recurring problems
- Copied from a template describing controls you do not have
- Written for a company of 500 when you are 40
- Never communicated, so staff cannot describe their obligations
- No named owner, so it is never updated
- Aspirational: it describes intent rather than current practice
Writing one that holds up
- Describe what you actually do today, then improve the practice and update the policy
- Keep each policy short enough that people will read it end to end
- Name an owner and a review date on every document
- Get explicit acknowledgement and keep the records as evidence
- Review whenever the underlying practice changes, not only annually
The honest tension
There is a real tension between writing what you do and writing what a framework expects. Resolve it by changing the practice, not by writing a policy you cannot honour.
An auditor who finds a policy requiring quarterly access reviews and no evidence of any review will raise a finding. A policy stating annual reviews, with evidence of annual reviews, passes. Overpromising in documentation is a self-inflicted finding.
Key takeaways
- Policies must describe actual practice, not aspiration.
- Auditors verify by asking staff, not just reading documents.
- Every policy needs an owner, review date and acknowledgement record.
- Do not promise a cadence you cannot evidence.
Frequently asked questions
Can we use policy templates?
As a starting structure, yes. They must then be rewritten to reflect your actual environment and practice.
How long should a policy be?
Short enough to be read. Two to four pages is usually plenty for a startup.
How often should they be reviewed?
At least annually, and whenever the practice they describe changes materially.
Do staff need to sign them?
You need evidence of acknowledgement. Electronic acceptance with a date and name is standard.
Get audit-ready in 8 to 12 weeks
Certifyi pairs the platform with a named compliance lead, with transparent, scope-based pricing.
Book a readiness call Start the free self-assessment