Policy set
The policies a SOC 2 Type I for Security, Confidentiality and Availability expects (ORG-09). Under Free first (28 Oct) we write them ourselves; a compliance platform (ORG-04), if chosen, ships a template for each; the rule is to edit every template down to what a two-to-five person team will actually do, because the auditor tests what the policy says, and a promise we do not keep is an exception in the report.
Every person signs each policy on joining and once a year (ORG-14). The signatures are recorded
in approvals.md and filed under docs/compliance/evidence/<year>/ (the
compliance platform, if one is chosen). Kyle approves the set; each policy names its own owner.
Review: yearly, or when the team or the systems change.
| Policy | What it must say for us | Draft here | Items |
|---|---|---|---|
| Information security | The umbrella: scope (the system inventory), roles, that policies are signed yearly | information-security-policy.md | ORG-09 |
| Acceptable use | What company accounts and SCOPE data may be used for | Section 4 of information-security-policy.md | ORG-14 |
| Access control | MFA everywhere, least privilege, quarterly review, access removed within 24 hours of leaving | Checklists in onboarding-offboarding.md | ORG-06, ORG-19, ORG-20 |
| BYOD and endpoint | Personal laptops: encryption, screen lock, updates, a quarterly device check | byod-policy.md | ORG-15, ORG-16 |
| Change management | Every change through a pull request, CI green, monthly review of merged PRs; migrations applied by hand until SC-6, then only by CI; emergency path | change-management-policy.md | SC-5, SC-6 |
| Incident response | Who is called, how fast, customer notice | incident-response-plan.md | LM-3 |
| Business continuity and disaster recovery | RPO, RTO, restore test, outage runbook | bc-dr-plan.md | AV-1 to AV-3 |
| Vendor management | Yearly report review, CUECs, subprocessor notice | subprocessors.md | VN-1 to VN-3 |
| Risk assessment | Yearly risk assessment, register reviewed quarterly | risk-register.md | ORG-17 |
| Data classification and handling | Confidential: CDL numbers, DOT medical cards, injury details, investigation findings. Internal: everything else | data-classification-and-retention.md | DB-5 |
| Data retention and disposal | OSHA 300/301 kept five years after the year they cover; customer data deleted at contract end on request; legal hold | data-classification-and-retention.md; the code side is DB-6 | DB-6 |
| Encryption | Data encrypted in transit (TLS) and at rest (Supabase and Vercel defaults); keys held by the providers | Section 6 of information-security-policy.md | |
| Secure development | Secret scanning, dependency updates with a 7-day rule for criticals, pen test yearly | Section 7 of information-security-policy.md | SC-3, SC-7, LM-4 |
| Human resources security | Background checks before production access, confidentiality agreement, training on joining and yearly | onboarding-offboarding.md | ORG-08, ORG-13, ORG-14 |
Watch the numbers. Write only the ones we will meet: "access removed within 24 hours", "critical patches within 7 days", "customer notified within 72 hours" (or whatever counsel puts in the contract). The auditor samples them.