Skip to content

The full set of 21 security policies, written for your stack.

Every policy in our library, tailored to your stack and team: the twelve in the Expanded set, plus nine more, with SOC 2 criteria cited throughout. It comes with a SOC 2 criteria map, one table showing where your policies cite each criterion and which criteria none of them cite. Flat fee. Seven business days after the day we have your answers.

Who it’s for. For small companies preparing for a SOC 2 audit, or answering a customer that wants a full policy set.

$395

Flat fee, paid once.

Order the 21 policies, $395

You pay on Stripe’s secure page. We never see your card details.

Refunds. If we decline your order or can't finish the work, you get a full refund. Ask before we have your answers and you get one too. The refund policy has the cases.

Who reads it. An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out. Who we are.

Delivery
7 business days after the day we have your answers
Formats
Markdown, Word, PDF
Revisions
2, within 10 business days of delivery
Twenty-one policy books on three steps, five in front, seven in the middle, and nine at the back, drawn as an isometric plan.

21 custom security policies, with a SOC 2 criteria map

What you get

  • Twenty-one policies: the twelve in the Expanded set, plus Secure Software Development, Human Resources Security, Asset Management, Data Retention and Disposal, Physical and Environmental Security, Network Security, Code of Conduct, Privacy Program (internal), and Remote Work and Mobile Device.
  • A SOC 2 criteria map: one table across all your delivered policies, plus a list of the SOC 2 criteria none of them cite. It maps your documents only. It is not an audit or an assessment of your controls.
  • Tailored to your intake answers: your cloud, your identity setup, your team size, and how you work.
  • SOC 2 Trust Services Criteria cited inline, so a reviewer can see which control area each section addresses.
  • Delivered as Markdown, Word, and PDF, the criteria map included.
  • Two revisions, both asked for within ten business days of the first delivery. If we get something wrong, we fix it when you tell us, and that doesn't use a revision.

See the standard first. Two full sample policies, written for a fictional company:

21 security policies

What we need from you

  • Intake answers, about 35 questions that take 10 to 15 minutes: company size and industry, tech stack and cloud provider, your target framework (SOC 2 Type I, Type II, or baseline policies), any policies you already have, and what prompted this.
  • We email the questions after you pay. You answer by reply.
  • An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out.

Three sets

Which set fits?

Each set includes the one before it, written from the same intake. Pick the one you will actually adopt: a reviewer compares every policy with how you really work.

What this is not

  • Documentation and readiness work only. Never an audit, an attestation, or a certification. SOC 2 attestation comes from an independent CPA firm.
  • No promise that your company will pass an audit, or that a customer will accept what we write.
  • Not penetration testing or vulnerability scanning. We never touch your systems.
  • The criteria map maps your documents only. It is not an audit or an assessment of your controls, and not a control matrix or a gap analysis. Those are quoted separately.
  • Written against the SOC 2 criteria and public NIST guidance. Not mapped to ISO 27001, and not a HIPAA, GDPR, or other privacy-law compliance program.

Practical rigor · No manufactured claims

How it works

From payment to delivery.

  1. Step 01

    You pay

    On Stripe's page, for a flat fee. We never see your card details.

  2. Step 02

    We send the intake

    We email you the intake questions after your order comes in.

  3. Step 03

    The clock starts

    Seven business days after the day your completed intake comes back to us. The day it arrives is not one of the seven. The sooner it arrives, the sooner you have your policies.

  4. Step 04

    We deliver, and revise

    The finished policies come by email. Ask for your revisions within ten business days of delivery.

Order the 21 security policies.

$395

Flat fee, paid once.

Order the 21 policies, $395

You pay on Stripe’s secure page. We never see your card details.

Questions

Questions about the 21 security policies.

Which set should I choose?
Core 5 if a customer or a questionnaire asked for your basic policies. The 12-policy set if reviewers are asking about risk, vendors, continuity, or change control. The 21-policy set if you are preparing for a SOC 2 audit and want every policy in our library plus the criteria map. A bigger set is a bigger read for your team, so pick the one you will actually adopt.
What is the SOC 2 criteria map?
Every policy already cites the SOC 2 Trust Services Criteria each section addresses. The map adds one table across all your delivered policies, plus the criteria none of them cite. It maps your documents only. It is not an audit or an assessment of your controls, and it is not a gap analysis.
What formats do the policies come in?
Markdown, Word, and PDF, so you can edit in whichever one you use.
What do the two revisions cover?
Two rounds of changes to the twenty-one policies we delivered, and to the criteria map. Ask for both within one ten-business-day window that starts when we first deliver. A revised set does not start a new one. Send all your changes for a round in one email: a role, a tool name, a retention period, or a clause that doesn't match how you work. We make every change, check that the policies still agree with each other, and send the set back. A revision changes what we delivered. It doesn't add a policy, a gap analysis, or a control matrix. Those are quoted separately.
Will these policies get us through a SOC 2 audit?
No document can promise that. We write readiness documentation, and we never audit, attest, or certify. A SOC 2 report comes from an independent CPA firm, which tests whether you do what the policies say.
Can I see what the policies look like first?
Yes. Above, there are two full sample policies, an Access Control policy and an Incident Response policy, written for a fictional company. Your twenty-one are written from your own intake answers.
Who reads them before they reach me?
An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out. We say so on this page and in the terms.
That is a lot of policies for a small team. Do we have to adopt all of them?
No. Adopt only what your company actually does and will follow, because a reviewer compares each policy with your real practice. If you are not sure you need all 21, the 12-policy set or the core five may fit better.
Can you write a policy that isn't in the 21?
Policy work beyond our library, control matrices, and gap analyses are quoted, not priced here. Email us and describe what you need.
Can you do faster than seven business days?
Not at the moment. Check that seven business days works for your date before you order.
Do you take every order?
We may decline an order before work starts, including for a conflict of interest, or end one if we can't finish the work. If we do, you get a full refund.

Your order is covered by our terms, refund policy, and privacy notice. Questions first? Email us.

Pricing

Other orders.

See every order and price

Need something bigger? Control matrices, gap analyses, and policy work beyond our 21-policy set are quoted.

Ask for a quote