Using the Policy Gallery

Acceptable Use Policy

Used to create a policy of acceptable usage of voicemail, email, and internet on company-issued devices.

Anti-Bribery and Corruption Policy

Used to create a policy to comply with all applicable anti-bribery laws.

Anti-Harassment and Discrimination Policy

Used to create a policy related to inappropriate conduct or comments to maintain a work environment free from discrimination and harassment.

Benefits Policy

Used to create a policy related to a comprehensive company benefit package.

Code of Conduct

Used to create a policy of expected employee conduct in the workplace. The policy includes sections on:

• Core Values

• Harassment and Discrimination

• Conflicts of Interest

• Bribery

• Whistleblowing

Complaint Policy

Used to create a policy related to reporting a complaint.

Conflict of Interest Policy

Used to create a policy related to situations where private activities or relationships conflict, or appear to conflict with the interest of the company.

Disciplinary Process

Used to create a document that outlines the process designed to ensure the correct and fair treatment of all employees who are suspected of violating company policies.

Document Control Policy

Used to create a policy that ensures control over the creation, approval, distribution, usage, and updates to company policies and procedures.

Gifts & Hospitality Policy

Used to create a policy to assist organizations in making responsible decisions regarding gifts and hospitality.

Illinois Biometric Information Privacy Act (BIPA) Governance Policy

Used to create a policy that is compliant with the Illinois BIPA by providing guidance on how businesses should manage the collection, sharing, storage, and disposal of employee biometric information through a well-defined Biometric Information Governance Policy.

Non-Solicitation and Distribution

Used to create a document to ensure a safe workplace free of disruptions and interruptions.

SANS Acceptable Encryption Policy

Used to create a policy to provide guidance that limits the use of encryption to algorithms that have received substantial public review and work effectively.

SANS Acceptable Use Policy

Used to create a policy to outline the acceptable use of computer equipment.

SANS Acquisition Assessment Policy

Used to create a policy to establish Infosec responsibilities regarding corporate acquisitions, and define the minimum security requirements of an Infosec acquisition assessment.

SANS Automatically Forwarded Email Policy

Used to create a policy to prevent the unauthorized or inadvertent disclosure of sensitive company information.

SANS Bluetooth Baseline Requirements Policy

Used to create a policy to provide a minimum baseline standard for connecting Bluetooth enabled devices to a network.

SANS Clean Desk Policy

Used to create a policy to establish the minimum requirements for maintaining a "clean desk" - where sensitive information about employees, property, customers, or vendors are secured.

SANS Communications Equipment Policy

Used to create a policy related to the company requirements for communication equipment security configurations.

SANS Data Breach Response Policy

Used to create a policy to establish the goals and the vision for the breach response process.

SANS Database Credentials Coding Policy

Used to create a policy to securely store and retrieve database usernames and passwords for use by a program that will access a database running on a company network.

SANS Dial-In Access Policy

Used to create a policy to protect electronic information from being inadvertently compromised by authorized personnel using a dial-in connection.

SANS Digital Signature Acceptance Policy

Used to create a policy to provide guidance on when digital signatures are considered accepted means of validating the identity of a signer in a company's electronic documents.

SANS Disaster Recovery Plan Policy

Used to create a policy related to defining the requirements for a baseline disaster recovery plan to be developed and implemented.

SANS Email Policy

Used to create a policy to ensure the proper use of email system and make users aware of what a company deems as acceptable and unacceptable use of its email system.

SANS Employee Internet Use Monitoring and Filtering Policy

Used to create a policy to define standards for systems that monitor and limit web use from any host within a company's network.

SANS End User Encryption Key Protection Policy

Used to create a policy that outlines the requirements for protecting encryption keys that are under the control of end users.

SANS Ethics Policy

Used to create a policy to establish a culture of openness, trust, and to emphasize employee and customer expectations to be treated to fair business practices.

SANS Extranet Policy

Used to create a policy under which third-party organizations connect to an organizations network.

SANS Information Logging Standard

Used to create a policy to define specific requirements that information systems must meet in order to generate appropriate audit logs and integrate with an enterprise's log management function.

SANS Internet DMZ Equipment Policy

Used to create a policy to define standards to be met by all equipment owned and operated by an organization located outside of the corporate internet firewalls.

SANS Internet Usage Policy

Used to create a policy to define the appropriate uses of the internet by employees and affiliates.

SANS Lab Security Policy

Used to create a policy to help manage and safeguard lab resources and networks by minimizing the exposure of critical infrastructure.

SANS Mobile Device Encryption Policy

Used to create a policy related to describing information security requirements for encrypting data at rest on mobile devices.

SANS Pandemic Response Planning Policy

Used to create a policy to address the reality that pandemic events can create personnel and technology issues outside the scope of the traditional Disaster Recovery/Business Continuity Planning.

SANS Password Construction Guidelines

Used to create guidelines related to best practices for creating strong passwords.

SANS Password Protection Policy

Used to create a standard for the creation of strong passwords and the protection of those passwords.

SANS Personal Communication Devices and Voicemail Policy

Used to create a policy related to describing information security requirements for personal communication devices and voicemail.

SANS Remote Access Policy

Used to create a policy to define rules and requirements for connecting to a company network from any host.

SANS Remote Access Tools Policy

Used to create a policy to define requirements for remote access tools used at an organization.

SANS Removable Media Policy

Used to create a policy to minimize the risk of loss or exposure of sensitive information and to reduce the risk of acquiring malware infections on computers.

SANS Risk Assessment Policy

Used to create a policy to perform security risk assessments (RAs) for the purpose of determining areas of vulnerability, and to initiate appropriate remediation.

SANS Router and Switch Security Policy

Used to create a policy to describe a required minimal security configuration for all routers and switches connecting to a production network.

SANS Security Response Plan Policy

Used to create a policy to establish the requirements to successfully respond to a security incident.

SANS Server Audit Policy

Used to create a policy to ensure all servers deployed at an organization are configured according to security policies.

SANS Server Malware Protection Policy

Used to create a policy to outline which server systems are required to have anti-virus and/or anti-spyware applications.

SANS Server Security Policy

Used to create a policy to establish standards for the base configuration of internal server equipment that is owned and/or operated by an organization.

SANS Social Engineering Awareness Policy

Used to create a policy to make employees aware of fraudulent social engineering attacks and how to detect them. The document also covers specific procedures for employees to follow when someone is contacting them to collect sensitive information.

SANS Software Installation Policy

Used to create a policy to outline the requirements around installation software on computing devices.

SANS Technology Equipment Disposal Policy

Used to create a policy to define the guidelines for the disposal of technology equipment and components.

SANS Web Application Security Policy

Used to create a policy to define web application security assessments.

SANS Wireless Communication Policy

Used to create a policy to secure and protect the information assets owned by an organization.

SANS Wireless Communication Standard

Used to create a standard of technical requirements that wireless infrastructure devices must satisfy to connect to the company network.

SANS Workstation Security (For HIPAA) Policy

Used to create a policy to provide guidance for workstation security to ensure the security of information on the workstation and information the workstation may have access to.

Speak Up Policy

Used to create a policy to report misconduct, illegal acts, or failure to observe company policies and procedures.

Sustainability Policy

Used to create a policy to minimize an organizations impact on the environment.

Termination of Employment

Used to create a document related to employee termination.

Workplace Guidelines and Safety Policy

Used to create a policy of workplace safety guidelines.