Skip to content

Twelve security policies, written for your stack.

The core five, plus seven more: Risk Management, Vendor Management, Business Continuity and Disaster Recovery, Change Management, Encryption and Key Management, Logging and Monitoring, and Vulnerability and Patch Management. Tailored to your stack and team, with SOC 2 criteria cited throughout. Flat fee. Five business days after the day we have your answers.

Who it’s for. For small companies asked for more than the core five: a risk process, vendor oversight, continuity, change control, encryption, logging, and patching.

$195

Flat fee, paid once.

Order the twelve policies, $195

You pay on Stripe’s secure page. We never see your card details.

Refunds. If we decline your order or can't finish the work, you get a full refund. Ask before we have your answers and you get one too. The refund policy has the cases.

Who reads it. An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out. Who we are.

Delivery
5 business days after the day we have your answers
Formats
Markdown, Word, PDF
Revisions
2, within 10 business days of delivery
Twelve policy books on two steps, five in front and seven behind, drawn as an isometric plan.

12 custom security policies

What you get

  • Twelve policies: the core five (Information Security, Access Control, Incident Response, Acceptable Use, and Data Classification), plus Risk Management, Vendor Management, Business Continuity and Disaster Recovery, Change Management, Encryption and Key Management, Logging and Monitoring, and Vulnerability and Patch Management.
  • Tailored to your intake answers: your cloud, your identity setup, your team size, and how you work.
  • SOC 2 Trust Services Criteria cited inline, so a reviewer can see which control area each section addresses.
  • Delivered as Markdown, Word, and PDF.
  • Two revisions, both asked for within ten business days of the first delivery. If we get something wrong, we fix it when you tell us, and that doesn't use a revision.

See the standard first. Two full sample policies, written for a fictional company:

12 security policies

What we need from you

  • Intake answers, about 35 questions that take 10 to 15 minutes: company size and industry, tech stack and cloud provider, your target framework (SOC 2 Type I, Type II, or baseline policies), any policies you already have, and what prompted this.
  • We email the questions after you pay. You answer by reply.
  • An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out.

Three sets

Which set fits?

Each set includes the one before it, written from the same intake. Pick the one you will actually adopt: a reviewer compares every policy with how you really work.

What this is not

  • Documentation and readiness work only. Never an audit, an attestation, or a certification. SOC 2 attestation comes from an independent CPA firm.
  • No promise that your company will pass an audit, or that a customer will accept what we write.
  • Not penetration testing or vulnerability scanning. We never touch your systems.
  • Not a control matrix or a gap analysis. Those are quoted separately.
  • Written against the SOC 2 criteria and public NIST guidance. Not mapped to ISO 27001, and not a HIPAA, GDPR, or other privacy-law compliance program.

Practical rigor · No manufactured claims

How it works

From payment to delivery.

  1. Step 01

    You pay

    On Stripe's page, for a flat fee. We never see your card details.

  2. Step 02

    We send the intake

    We email you the intake questions after your order comes in.

  3. Step 03

    The clock starts

    Five business days after the day your completed intake comes back to us. The day it arrives is not one of the five. The sooner it arrives, the sooner you have your policies.

  4. Step 04

    We deliver, and revise

    The finished policies come by email. Ask for your revisions within ten business days of delivery.

Order the 12 security policies.

$195

Flat fee, paid once.

Order the twelve policies, $195

You pay on Stripe’s secure page. We never see your card details.

Questions

Questions about the 12 security policies.

Which set should I choose?
Core 5 if a customer or a questionnaire asked for your basic policies. The 12-policy set if reviewers are asking about risk, vendors, continuity, or change control. The 21-policy set if you are preparing for a SOC 2 audit and want every policy in our library plus the criteria map. A bigger set is a bigger read for your team, so pick the one you will actually adopt.
What formats do the policies come in?
Markdown, Word, and PDF, so you can edit in whichever one you use.
What do the two revisions cover?
Two rounds of changes to the twelve policies we delivered. Ask for both within one ten-business-day window that starts when we first deliver. A revised set does not start a new one. Send all your changes for a round in one email: a role, a tool name, a retention period, or a clause that doesn't match how you work. We make every change, check that the policies still agree with each other, and send the set back. A revision changes what we delivered. It doesn't add a policy, a gap analysis, or a control matrix. Those are quoted separately.
Will these policies get us through a SOC 2 audit?
No document can promise that. We write readiness documentation, and we never audit, attest, or certify. A SOC 2 report comes from an independent CPA firm, which tests whether you do what the policies say.
Can I see what the policies look like first?
Yes. Above, there are two full sample policies, an Access Control policy and an Incident Response policy, written for a fictional company. Your twelve are written from your own intake answers.
Who reads them before they reach me?
An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out. We say so on this page and in the terms.
What if we have nothing written down yet?
That is common for early-stage teams. Your intake answers are what we work from.
Can I add one more policy, or the SOC 2 criteria map?
Not on this order. The 21-policy set includes every policy in our library and the map. For a policy outside the library, or anything else, email us and describe what you need, and we can quote it.
Can you do faster than five business days?
Not at the moment. Check that five business days works for your date before you order.
Do you take every order?
We may decline an order before work starts, including for a conflict of interest, or end one if we can't finish the work. If we do, you get a full refund.

Your order is covered by our terms, refund policy, and privacy notice. Questions first? Email us.

Pricing

Other orders.

See every order and price

Need something bigger? Control matrices, gap analyses, and policy work beyond our 21-policy set are quoted.

Ask for a quote