Drafted policies and procedures in a controlled-document layout, ready to adapt. Free with an account, as PDF.
59 templates: ISMS framework, Access, assets and people, Technology and operations, Resilience, suppliers, privacy and compliance.
Browse the ISO 27001 set →24 templates: SMS framework, Service portfolio and relationships, Design, change and release, Resolution and assurance, Performance and improvement.
Browse the ISO 20000-1 set →Every template has the same shape: document details and revision history, a contents list, then purpose, scope, roles and responsibilities, the policy or procedure itself, records kept as evidence, exceptions, enforcement, review, related documents, and a table of the standard's clauses and controls it supports.
They are written to be edited. Anything that is your decision (a period, a threshold, a tool) is left in square brackets, so a template cannot be adopted unchanged and look as if someone had decided.
ISO/IEC 27001 is about protecting information: it asks you to understand your risks, choose controls and keep evidence that they work. ISO/IEC 20000-1 is about running services well: incidents, changes, requests and service levels handled as repeatable processes. A company selling software or outsourced services to enterprise customers often needs both, because the customer wants to know the information is safe and that the service will be there.
Start with the core documents: the information security policy, the scope statement, the risk assessment procedure and the Statement of Applicability. Replace everything in square brackets with your own decision, delete anything that does not describe what you really do, and add what is missing. A policy that promises more than the organisation practises is a finding waiting to happen, so keep the wording true. Then have the owner and top management approve it under your document control, record it in the revision history, and tell the people it applies to.
Auditors read your documents against your behaviour. They look for a policy that matches what staff say they do, records that show it was followed, and evidence that problems found were fixed. The records section of each template lists what to keep.
They are drafted starting points in a controlled-document layout, citing the clauses and controls they help satisfy. They are not legal advice and they do not make an organisation compliant or certified. Certification is decided by an accredited body on the basis of your own system. If you would like help adapting them or preparing for audit, talk to us.