Security Policy Generator

Security policies are the foundation of any organization's cybersecurity posture. They define the rules, responsibilities, and expectations that govern how your organization protects its information assets. Without documented policies, security efforts are ad hoc, inconsistent, and difficult to enforce.

Under regulations like NIS2 and GDPR, documented security policies are not just best practice — they are a legal requirement. NIS2 Article 21 explicitly requires covered entities to implement policies on risk analysis, incident handling, business continuity, supply chain security, and more. GDPR Article 24 requires organizations to implement appropriate technical and organizational measures and to be able to demonstrate compliance.

Beyond compliance, security policies serve practical purposes: they set clear expectations for employees, provide a framework for consistent decision-making, reduce the risk of human error, and demonstrate due diligence to customers, partners, auditors, and regulators.

Clear and Concise

Policies should be written in plain language that all employees can understand — not just IT staff. Avoid unnecessary jargon. A policy nobody reads provides no protection.

Specific and Actionable

Vague statements like "employees should practice good security" are useless. Effective policies specify concrete requirements: minimum password length, MFA requirements, data handling procedures, reporting channels.

Enforceable

Every policy must have clear consequences for violations and a practical mechanism for enforcement. A policy without enforcement is just a suggestion.

Regularly Reviewed

Security policies must be living documents. They should be reviewed at least annually and updated whenever there are significant changes to the organization, its technology, or the regulatory landscape.

Approved by Management

Policies carry weight only when they have visible management support. Under NIS2 Article 20(1), the management body must approve the cybersecurity risk-management measures, which include the security policies, and oversee their implementation — a legal obligation, not just a best practice.

Information Security Policy is the overarching document that establishes your organization's security governance framework. It defines security principles, roles and responsibilities, and references all other security policies. Every organization needs this as the foundation.

Acceptable Use Policy defines how employees may use company IT resources — email, internet, devices, software, and cloud services. It prevents misuse, sets expectations, and protects the organization legally.

Password and Authentication Policy specifies password length and screening rules in line with NIST SP 800-63B, multi-factor authentication rules, and credential management practices. Weak authentication remains a top attack vector.

Incident Response Policy establishes procedures for detecting, reporting, and responding to security incidents. Under NIS2, you must be able to send an early warning about significant incidents within 24 hours — having this policy in place before an incident is critical.

Remote Work Security Policy addresses the security requirements for employees working from home or other remote locations. With hybrid work now standard, this policy is essential for protecting data outside the corporate network.

Data Classification Policy creates a framework for categorizing information by sensitivity level and defines handling requirements for each level. Without classification, all data receives the same (usually inadequate) protection.

Vendor Management Policy governs how your organization assesses and manages third-party risk. NIS2 Article 21(2)(d) specifically requires supply chain security measures, making this policy a compliance necessity.

Business Continuity Plan ensures your organization can maintain critical operations during disruptions. NIS2 requires covered entities to have business continuity and crisis management procedures in place.

Most companies now have staff using AI assistants, and many have agents that read email, update records or call other systems through plug-ins and MCP servers. An acceptable use policy written before agents existed does not answer the questions that matter now: which tools may an agent connect to, whose credentials does it use, and which of its actions need a person's approval?

The free AI Agent and MCP Use Policy sets those rules in up to 16 sections: an approved-tools list and an agent register, vetting and pinning MCP servers and fingerprinting their tool lists, a separate identity and scoped credentials for each agent, actions that always need human approval (sending data out, payments, deletions, access changes, legally binding acts and decisions about people), a rule against the exfiltration path (untrusted input, private data and an outbound channel in one agent), logging, a tested kill switch, training and prohibited practices.

Three extra questions tailor it. If your agents only assist staff, the approval section is left out; if they do not use MCP servers or plug-ins, the tool-vetting section is left out; if they process personal data, a GDPR section covers the legal basis, records of processing, DPIAs, processor agreements and automated decisions (Arts. 6, 22, 28, 30 and 35); if you run customer-facing agents, a transparency section covers the AI Act's chatbot and deepfake disclosure rules (Art. 50). For EU organizations, the training section reflects the AI literacy duty in Article 4 of the AI Act as amended in 2026: take measures to support the AI literacy of staff who use AI systems. Answer "Not sure" and the section is included.

The rules follow the OWASP Top 10 for Agentic Applications (2026) and the MCP specification's security best practices, and match our MCP Tool List and Agent Card Check and AI Agent Risk Calculator. To put the policy into practice, the AI Agent Governance Pack adds the agent register, delegation matrix, risk workbook, DPIA template and incident playbook.

Our policy generator uses a template-based approach. You select a policy type, answer questions about your organization (name, sector, size, regions, security lead title), and the generator produces a customized policy document using your details.

The generated policy is displayed as formatted HTML that you can copy to your clipboard and paste into your word processor for further editing. All generation happens in your browser — no data is sent to any server.

Four policies are available for free: Information Security Policy, Acceptable Use Policy, Password & Authentication Policy, and AI Agent and MCP Use Policy. For the 8 core security policies in professionally formatted Word documents with implementation checklists, see our Security Policy Bundle.