create-filegrc 0.1.0

package/template/data/policies/policy-anti-bribery-corruption.md

@@ -0,0 +1,87 @@
+# Anti-Bribery and Corruption Policy
+
+## Purpose
+
+{{company_name}} conducts business honestly and complies with applicable anti-bribery and anti-corruption laws. No business result justifies offering, requesting, accepting, or concealing an improper payment or benefit.
+
+## Scope
+
+This policy applies to employees, contractors, officers, directors, agents, consultants, and third parties acting for {{company_name}}.
+
+## Prohibited conduct
+
+Covered persons must not directly or indirectly:
+
+- Offer, promise, authorize, give, request, or accept anything of value to improperly influence a decision.
+- Reward someone for misusing a position of trust.
+- Use a third party to do something this policy prohibits.
+- Make facilitation or expediting payments, except when necessary to prevent an immediate threat to health or safety.
+- Create false, incomplete, misleading, or undisclosed records.
+- Retaliate against someone who raises a concern in good faith.
+
+"Anything of value" includes money, gifts, meals, travel, entertainment, discounts, services, employment opportunities, charitable contributions, political contributions, and benefits provided to a recipient's family or associates.
+
+## Government officials
+
+Interactions with government officials require added care. The term includes elected and appointed officials, employees of government agencies or state-controlled entities, political candidates, public international organizations, and anyone acting in an official capacity.
+
+No payment, gift, or benefit may be offered to a government official to obtain or retain business, avoid a requirement, influence an official act, or secure an improper advantage.
+
+## Gifts, meals, travel, and entertainment
+
+Business courtesies must:
+
+- Have a legitimate business purpose.
+- Be reasonable, infrequent, and appropriate to the circumstances.
+- Comply with the recipient's rules and applicable law.
+- Never consist of cash or a cash equivalent.
+- Never be intended to influence a pending decision.
+- Be recorded accurately when {{company_name}} pays for them.
+
+The policy owner must approve any courtesy that could reasonably appear improper.
+
+## Political and charitable contributions
+
+Company funds, property, or services may not be used for political contributions without written approval from the policy owner and confirmation that the contribution is lawful.
+
+Charitable contributions must have a documented charitable purpose and may not benefit a decision-maker personally or act as a substitute for an improper payment.
+
+## Third parties
+
+Before engaging an agent, consultant, reseller, or other intermediary who may interact with customers or officials on {{company_name}}'s behalf, the responsible owner must:
+
+1. Perform risk-based due diligence.
+2. Confirm the service and compensation are commercially reasonable.
+3. Use a written agreement describing the service and requiring lawful conduct.
+4. Approve and retain invoices and supporting records.
+5. Monitor for unusual requests, payment methods, or relationships.
+
+Warning signs must be resolved before engagement or payment. Examples include:
+
+- A request for payment to an unrelated person, unusual account, or country unrelated to the work.
+- Vague services, excessive commissions, or invoices that do not match the agreement.
+- A close relationship with a government official or decision-maker.
+- Refusal to complete due diligence or sign appropriate contract terms.
+- A request to hide a person's identity, role, or the purpose of a transaction.
+
+## Books and records
+
+Transactions must be recorded promptly, accurately, and with enough detail to explain their purpose. Undisclosed accounts, false descriptions, fabricated invoices, and off-book transactions are prohibited.
+
+## Reporting
+
+Report questions, suspected violations, requests for improper payments, or inaccurate records to {{policy_owner_name}} at {{security_contact_email}}. Reports may be made without first notifying a manager.
+
+{{company_name}} prohibits retaliation against anyone who reports a concern or participates in an investigation in good faith.
+
+## Investigations and enforcement
+
+{{company_name}} will review credible reports promptly and limit disclosure to people who need the information. Covered persons must preserve relevant records and cooperate honestly.
+
+Violations may result in removal of authority, termination of a contract or employment relationship, recovery of funds, and referral to authorities when appropriate.
+
+## Training and review
+
+People in higher-risk roles complete assigned anti-bribery training within 30 days of starting those duties or changing into a covered role. Covered roles include work involving sales, procurement, payments, gifts or hospitality, government interaction, higher-risk locations, or third parties acting for {{company_name}}. The onboarding or role-change checklist records the training assignment or why it does not apply.
+
+This policy is reviewed at least annually and after a material legal, geographic, or business change.

package/template/data/policies/policy-clear-desk-screen.json

@@ -0,0 +1,24 @@
+{
+  "schemaVersion": 1,
+  "id": "policy-clear-desk-screen",
+  "type": "policy",
+  "title": "Clear Desk and Clear Screen Policy",
+  "status": "draft",
+  "ownerIds": ["person-policy-owner"],
+  "approverIds": ["person-independent-approver"],
+  "policyKind": "information-security",
+  "version": "1.0",
+  "effectiveOn": "{{effective_date}}",
+  "reviewCadence": {
+    "mode": "calendar",
+    "unit": "year",
+    "interval": 1,
+    "anchorDate": "{{effective_date}}"
+  },
+  "audience": ["employees", "contractors"],
+  "acknowledgementRequired": true,
+  "controlIds": [
+    "control-policy-management",
+    "control-physical-workspace-security"
+  ]
+}

package/template/data/policies/policy-clear-desk-screen.md

@@ -0,0 +1,49 @@
+# Clear Desk and Clear Screen Policy
+
+## Purpose
+
+{{company_name}} protects confidential information from accidental exposure, theft, and unauthorized access in offices, shared spaces, and remote work locations.
+
+## Scope
+
+This policy applies to employees and contractors who handle company, customer, workforce, or vendor information.
+
+## Clear desk requirements
+
+When a workspace is unattended:
+
+- Store confidential papers and removable media in a locked or access-controlled location.
+- Remove passwords, access codes, keys, badges, and authentication devices from view.
+- Do not leave payment information, identity documents, contracts, customer lists, or personnel records exposed.
+- Retrieve sensitive print jobs immediately.
+- Dispose of sensitive paper in an approved secure-destruction container.
+- Return shared meeting rooms and work areas to a clean state.
+- Secure portable equipment with a physical lock or security cable where practical.
+
+At the end of the workday, secure confidential material and company equipment.
+
+## Clear screen requirements
+
+- Lock the screen whenever leaving a device unattended.
+- Configure automatic screen locking after no more than 15 minutes of inactivity.
+- Position screens to reduce unnecessary viewing by visitors or the public.
+- Use a privacy screen when confidential information must be viewed in a public or shared location.
+- Close files and applications that are no longer needed.
+- Do not display passwords, secrets, or recovery codes on monitors or notes.
+- Do not leave sensitive files, shortcuts, diagrams, or other information exposed on a shared desktop or display.
+
+## Remote work
+
+Remote workers must choose a workspace where household members, visitors, and the public cannot casually view or access confidential information. Voice and video calls involving confidential matters must be conducted where they cannot be overheard.
+
+## Visitors
+
+Visitors must remain in authorized areas and be supervised where confidential information or systems are present. Hosts are responsible for clearing exposed information before a visitor arrives.
+
+## Lost material or suspected exposure
+
+Report lost papers, devices, badges, removable media, or suspected unauthorized viewing immediately to {{policy_owner_name}} at {{security_contact_email}}.
+
+## Enforcement and review
+
+Failure to follow this policy may lead to access restrictions or disciplinary action. The policy owner reviews this policy at least annually.

package/template/data/policies/policy-data-protection-handling.json

@@ -0,0 +1,34 @@
+{
+  "schemaVersion": 1,
+  "id": "policy-data-protection-handling",
+  "type": "policy",
+  "title": "Data Protection and Handling Policy",
+  "status": "draft",
+  "ownerIds": ["person-policy-owner"],
+  "approverIds": ["person-independent-approver"],
+  "policyKind": "information-security",
+  "version": "1.0",
+  "effectiveOn": "{{effective_date}}",
+  "reviewCadence": {
+    "mode": "calendar",
+    "unit": "year",
+    "interval": 1,
+    "anchorDate": "{{effective_date}}"
+  },
+  "audience": ["employees", "contractors", "vendors"],
+  "acknowledgementRequired": true,
+  "relatedDocumentIds": ["document-data-retention-schedule"],
+  "controlIds": [
+    "control-policy-management",
+    "control-risk-assessment",
+    "control-access-authorization",
+    "control-access-review-offboarding",
+    "control-data-classification-inventory",
+    "control-encryption-transmission",
+    "control-data-retention-disposal",
+    "control-incident-response",
+    "control-vendor-due-diligence",
+    "control-vendor-monitoring",
+    "control-security-exceptions"
+  ]
+}

package/template/data/policies/policy-data-protection-handling.md

@@ -0,0 +1,130 @@
+# Data Protection and Handling Policy
+
+## Purpose
+
+This policy defines how {{company_name}} classifies, accesses, uses, stores, shares, retains, and disposes of data.
+
+## Scope
+
+This policy applies to employees, contractors, vendors, systems, devices, and records that create, receive, process, store, or transmit data on behalf of {{company_name}}.
+
+## Responsibilities
+
+{{policy_owner_name}} owns this policy. System and data owners decide which data a system may process, assign classifications, approve access, and set retention requirements. Everyone in scope must handle data according to its classification and report suspected loss or misuse.
+
+Questions and reports should be sent to {{security_contact_email}}.
+
+## Data classification
+
+Data owners assign the highest classification required by the data in a record, file, system, or transfer.
+
+| Classification | Description | Examples | Minimum handling |
+| --- | --- | --- | --- |
+| Public | Approved for public release | Published web content and public documentation | Protect integrity and use approved publishing processes |
+| Internal | Intended for the workforce and approved partners | Internal procedures and routine business records | Limit access to people with a business need |
+| Confidential | Disclosure could harm {{company_name}}, a customer, or another person | Contracts, financial records, customer data, source code, and security records | Approved systems, access control, encryption in transit and at rest, and protected sharing |
+| Restricted | Disclosure or alteration could cause severe harm or trigger legal duties | Credentials, cryptographic keys, regulated data, and highly sensitive security material | Explicit approval, least privilege, encryption in transit and at rest, and additional monitoring |
+
+When classification is uncertain, treat the data as Confidential until its owner decides.
+
+Credentials, private keys, authentication tokens, and recovery codes must be stored in an approved secrets-management system. Do not put them in source files, tickets, chat messages, policy records, or other general-purpose repositories.
+
+## Data inventory and ownership
+
+{{company_name}} maintains records of systems and important data stores. Those records identify:
+
+- An accountable owner
+- Business purpose
+- Data types and classification
+- Source and authorized recipients
+- Retention or deletion requirements
+- Important vendors and processing locations
+- Security and recovery needs
+
+Owners review their records at least annually and after a material change.
+
+## Collection and use
+
+Collect only data needed for an approved business purpose. Tell people how their personal data will be used when required. Do not reuse data for an incompatible purpose without review and approval.
+
+Access must follow least privilege. Owners approve access based on job duties, and managers or system owners review access at least quarterly for systems containing Restricted data and at least annually for other important systems.
+
+Do not browse, copy, export, or analyze data out of curiosity or for personal use.
+
+## Access approval and removal
+
+Access to Confidential or Restricted data follows this process:
+
+1. A manager or data owner requests access for a stated role and business need.
+2. The reviewer checks that the requested access is the minimum needed.
+3. The system owner or security owner approves elevated or sensitive access.
+4. An authorized administrator provisions the access and records the decision.
+5. Access changes and removals follow the same approval and recording requirements. Departures and role changes are handled promptly under the Information Security Policy.
+
+## Storage
+
+Internal, Confidential, and Restricted data must be stored in services approved for its classification. Local storage should be limited to a business need.
+
+Confidential and Restricted data must be encrypted in transit over untrusted networks and at rest in approved systems and on devices. Encryption keys and data must have separate access controls where practical.
+
+Production data must not be copied into development or test systems unless the owner approves the use and those systems meet the same protection requirements. Prefer generated or de-identified test data.
+
+Paper records containing Confidential or Restricted data must be secured when unattended and destroyed with an approved method.
+
+## Sharing and transfer
+
+Before sharing Confidential or Restricted data, verify:
+
+- The recipient and business need
+- The minimum data required
+- The recipient's authorization
+- The transfer method and destination
+- Contractual, privacy, and geographic restrictions
+
+Use approved encrypted channels. Do not send Restricted data through personal email, consumer file-sharing accounts, or unapproved messaging services.
+
+Public links must not be used for Confidential or Restricted data. Time-limit external access where the system supports it, and remove access when the business need ends.
+
+## Vendors and subprocessors
+
+Vendors that process Confidential or Restricted data must complete a security and privacy review before access begins. Contracts must state the permitted use, protection, incident notification, return or deletion, and any required audit rights.
+
+Owners review critical vendors at least annually and when the service or data use changes materially.
+
+## Retention and disposal
+
+Keep data only as long as required for its business purpose and applicable legal, contractual, tax, audit, or security needs. Data owners document retention rules for important record classes in the Data Retention Schedule.
+
+When retention ends, delete or anonymize the data through an approved process. Approved methods include cryptographic erase or secure wiping for reusable media and physical destruction, pulverization, or shredding for media that will not be reused. Choose a method suited to the medium and data classification.
+
+Disposal must cover active systems, local copies, and vendor-held data where practical. Backup copies may expire through the normal protected backup cycle if they cannot be selectively deleted.
+
+Legal holds and active investigations suspend normal deletion for the affected data.
+
+The policy owner reviews the Data Retention Schedule at least annually and within 30 days after a material change to systems, data use, vendors, contracts, or applicable duties. The schedule's approver must be separate from its owner.
+
+## Personal data requests
+
+Requests to access, correct, export, restrict, or delete personal data must be sent to the responsible privacy or legal owner. Track the request using the minimum personal data needed. This repository should use an opaque case ID and an approved-system reference when keeping the person's identity in Git would conflict with deletion duties.
+
+## Security incidents
+
+Report suspected loss, unauthorized access, unintended disclosure, or improper disposal immediately to {{security_contact_email}}. Do not delete evidence, contact affected people, or make external statements unless the incident lead authorizes it.
+
+{{company_name}} will investigate, contain, document, and notify affected parties as required by its incident process and applicable obligations.
+
+## Training and compliance
+
+Workers receive data-handling training when they join and at least annually. Additional training may be required for people who handle Restricted data.
+
+People who develop or materially change applications complete secure-development training within 30 days of starting those duties or changing into a covered role. Training covers common application risks, access control, input handling, secrets, logging, dependencies, and secure review.
+
+Violations may result in access removal, corrective action, contract remedies, or other action allowed by law and agreement.
+
+Exceptions require a documented business reason, owner, risk assessment, compensating controls, expiration date, and approval from {{policy_owner_name}}.
+
+## Review
+
+{{company_name}} assesses data-protection risks at least annually, either as part of the information security risk assessment or as a separate assessment. The assessment covers material changes in data use, systems, vendors, contracts, and applicable duties.
+
+The policy owner reviews this policy at least annually and after a material change to data use, law, contracts, or systems. Git history records approvals and changes.

package/template/data/policies/policy-employee-handbook.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": 1,
+  "id": "policy-employee-handbook",
+  "type": "policy",
+  "title": "Employee Handbook",
+  "status": "draft",
+  "ownerIds": ["person-policy-owner"],
+  "approverIds": ["person-independent-approver"],
+  "policyKind": "workforce-conduct",
+  "version": "1.0",
+  "effectiveOn": "{{effective_date}}",
+  "reviewCadence": {
+    "mode": "calendar",
+    "unit": "year",
+    "interval": 1,
+    "anchorDate": "{{effective_date}}"
+  },
+  "audience": ["employees"],
+  "acknowledgementRequired": true,
+  "controlIds": [
+    "control-security-governance",
+    "control-policy-management",
+    "control-security-communication",
+    "control-workforce-expectations",
+    "control-performance-review"
+  ],
+  "relatedDocumentIds": [
+    "document-employee-handbook-acknowledgement",
+    "document-employee-policy-acknowledgement"
+  ]
+}

package/template/data/policies/policy-employee-handbook.md

@@ -0,0 +1,161 @@
+# Employee Handbook
+
+## Purpose and status
+
+This optional handbook template sets a common baseline for employment practices, workplace conduct, information security, and use of {{company_name}} resources. An employee handbook is not required for SOC 2.
+
+It is not an employment contract or legal advice. It does not promise employment for a fixed term or change any written employment agreement. Local law, written employment terms, benefit plans, and approved regional supplements control when they differ from this handbook. Do not approve or distribute this template until qualified counsel has reviewed it for each place where {{company_name}} employs people and the company has named its people contact, reporting routes, and required regional supplements.
+
+## Scope and responsibility
+
+This handbook applies to employees. Contractors follow the conduct and security requirements assigned to them under their agreements and applicable policies.
+
+Managers are responsible for applying this handbook fairly, seeking advice when local requirements are unclear, and raising concerns instead of resolving serious matters informally. Employees are responsible for reading the handbook, asking questions, following applicable requirements, and reporting suspected violations.
+
+Questions about employment, conduct, accommodations, pay, leave, or workplace safety should be sent to a manager or the designated people contact through the published company reporting route. Security events should be sent to {{security_contact_email}}.
+
+## Communication and problem solving
+
+Employees should raise routine work questions with their manager. When the issue is not resolved, cannot reasonably be raised with that manager, or affects more than one team, the employee may contact the designated people contact. Employees may also use any reporting route required by law or another company policy.
+
+Managers should listen, gather the relevant facts, explain decisions they are authorized to make, and route matters that require another owner. Employees do not need to follow this informal path before reporting misconduct or exercising a legal right.
+
+## Reporting concerns
+
+Employees should promptly report suspected harassment, discrimination, retaliation, fraud, bribery, unsafe conditions, security events, misuse of data, or other policy violations. A non-security report may be made to a manager, the designated people contact, or another published independent route. Security and data events may also be reported to {{security_contact_email}}. If a person receiving reports is involved in the concern, the employee should use another route. A written report is not required.
+
+{{company_name}} will review reports promptly and impartially, preserve relevant records, limit disclosure to people who need the information, and take appropriate corrective action when warranted. Employees must cooperate honestly. No one may retaliate against a person who makes a good-faith report, requests an accommodation, raises a pay or safety concern, or participates in a review.
+
+## Equal opportunity and accommodations
+
+Employment decisions are based on job-related qualifications, performance, business needs, and lawful requirements. {{company_name}} prohibits unlawful discrimination based on a characteristic protected in the employee's work location.
+
+{{company_name}} provides reasonable accommodations for disability, religion, pregnancy and related conditions, and other protected needs when required by law. Employees may request an accommodation from their manager or the designated people contact without using special words. {{company_name}} and the employee will discuss the work limitation, possible accommodations, and any information lawfully needed to evaluate the request. Retaliation for requesting or using an accommodation is prohibited.
+
+## Harassment and respectful conduct
+
+Harassment, bullying, threats, and other abusive conduct are prohibited. Unlawful harassment includes unwelcome conduct tied to a protected characteristic when the conduct creates a hostile work setting or affects an employment decision.
+
+Prohibited conduct may include slurs, insults, threats, unwanted sexual attention, repeated offensive jokes, degrading images, unwelcome touching, or conditioning a work benefit on personal or sexual conduct. Harassment can occur between people of any role or identity, and a person may report conduct even when it was directed at someone else.
+
+These rules apply in offices, remote work, digital channels, travel, customer interactions, social events connected to work, and any other setting where conduct affects the workplace.
+
+## Ethical conduct and conflicts
+
+Act honestly and in the best interests of {{company_name}} while performing company work. Follow applicable laws, contracts, and company policies.
+
+Disclose an actual or potential conflict of interest to the policy owner before taking part in the related decision. This includes a financial interest, outside role, close personal relationship, gift, or other circumstance that could affect judgment.
+
+Do not offer, request, authorize, or accept a bribe, kickback, or improper payment. Gifts and entertainment must follow the Anti-Bribery and Corruption Policy.
+
+Keep complete and accurate business records. Do not hide, falsify, backdate, or destroy information to mislead another person or avoid a review.
+
+Only an authorized spokesperson may make public statements or respond to press, investor, or government inquiries on behalf of {{company_name}}.
+
+## Confidentiality and intellectual property
+
+Protect nonpublic information received from {{company_name}}, customers, workers, vendors, and partners. Use it only for approved work, share it only with authorized people, and follow the Data Protection and Handling Policy.
+
+Employment terms and applicable law determine ownership of work product and intellectual property. Employees must sign any required confidentiality and invention-assignment agreements.
+
+Confidentiality duties continue after employment ends. Nothing in this handbook prohibits lawful reporting to a regulator, discussion of working conditions, or another activity protected by law.
+
+## Company systems and acceptable use
+
+Use company systems, accounts, funds, devices, and other property for authorized purposes. Limited personal use may be allowed when it does not interfere with work, create material cost or risk, violate policy, or break the law.
+
+Do not use company systems to:
+
+- Break the law or another person's rights.
+- Create or distribute discriminatory, harassing, threatening, obscene, or malicious material.
+- Access systems or data without authorization.
+- Run a personal business or political campaign without approval.
+- Send mass unsolicited messages.
+- Install unapproved software that creates material risk.
+- Disable, evade, or interfere with security, monitoring, access, or retention controls.
+
+{{company_name}} may log, review, preserve, or disclose activity on company-managed systems as allowed by law and for security, operations, support, compliance, and investigation. Employees should not expect personal privacy in company accounts or devices beyond what law and written policy require.
+
+Employees must protect system integrity, use approved storage and communications tools, and return or delete company data and property when instructed.
+
+## Security responsibilities
+
+Every employee must:
+
+- Complete assigned security and policy training within 30 days of starting and at least annually.
+- Use a unique company identity and approved authentication methods.
+- Enable multi-factor authentication when required.
+- Store passwords and secrets only in approved tools.
+- Keep devices supported, encrypted, locked when unattended, and updated.
+- Follow data classification, clear-screen, mobile-computing, and acceptable-use requirements.
+- Use approved systems for company work.
+- Report suspected phishing, data loss, account compromise, policy violations, and other security events immediately to {{security_contact_email}}.
+- Cooperate with access reviews, investigations, recovery exercises, and audit requests.
+
+Do not bypass security controls, share accounts, or access data without a business need.
+
+## Remote work and travel
+
+Remote and traveling employees must maintain a work setting that protects company conversations, screens, paper records, and devices. Use trusted networks or approved secure access methods. Do not leave devices unattended in public or checked baggage.
+
+Employees remain responsible for attendance, communication, security, safety, and work expectations regardless of location. Approval to work remotely does not authorize work from every location because tax, employment, security, and customer duties may apply.
+
+## Employment classification and records
+
+Written employment terms identify whether a role is full-time, part-time, temporary, exempt, non-exempt, or another classification recognized in the employee's location. Classification affects pay, timekeeping, benefits, and leave, so employees should raise questions promptly.
+
+Employees must keep contact, tax, payment, emergency, and work-authorization records current through the approved process. {{company_name}} limits access to personnel records and uses them only for lawful business purposes.
+
+Requests for employment verification or references must be sent to the authorized people contact.
+
+## Work time, attendance, and pay
+
+Employees must follow their assigned schedule, attend required meetings, and notify their manager promptly when they will be late or absent. Repeated absence, lateness, or failure to report an absence may lead to corrective action, subject to protected leave and local law.
+
+Non-exempt employees must record all time worked accurately, including approved remote work and work outside the usual schedule. Managers must not ask an employee to work off the clock, omit time, or create a false record.
+
+Where overtime approval applies, employees must obtain approval before working overtime. {{company_name}} will still record and pay all hours that law requires, even when the employee did not obtain advance approval. A failure to follow the approval process may be addressed separately.
+
+Written employment terms state the pay schedule and available payment methods. Employees should review pay records and promptly report a suspected error.
+
+## Leave, holidays, and benefits
+
+Benefit plans, written leave policies, and regional supplements define eligibility, enrollment, coverage, holidays, paid time off, sick leave, and other benefits. The applicable plan document controls if a summary conflicts with it.
+
+Employees should request planned leave in advance and give prompt notice when illness or an emergency makes advance notice impractical. {{company_name}} may request only the documentation allowed and needed to administer the leave.
+
+{{company_name}} provides legally required leave and workplace support, which may include family or medical leave, disability leave, pregnancy-related leave, military leave, jury or witness duty, voting leave, work-injury leave, lactation accommodations, and other location-specific rights. A regional supplement or written policy defines duration, pay, eligibility, notice, and return-to-work rules.
+
+{{company_name}} maintains workers' compensation insurance or equivalent coverage where required. Employees must promptly report a work-related injury or illness so the company can address safety and required benefits.
+
+## Expenses
+
+{{company_name}} reimburses approved business expenses under its written expense process and applicable law. Employees must obtain required approval, submit accurate records on time, and return refunds or credits. Do not split, disguise, or misclassify an expense to avoid review.
+
+## Health, safety, and workplace security
+
+Follow workplace safety instructions and report hazards, injuries, threats, or violence as soon as practical after becoming aware of them. Call local emergency services when someone faces an immediate threat.
+
+Threats, intimidation, fighting, stalking, and workplace violence are prohibited. Weapons are prohibited where company rules and applicable law allow such a restriction. Employees must not work while impaired by alcohol, illegal drugs, or another substance that makes the work unsafe.
+
+Smoking and vaping are allowed only in approved areas and as permitted by local rules. Employees must follow emergency, visitor, facility-access, and incident-reporting procedures.
+
+## Performance and corrective action
+
+Employees are expected to meet job requirements, follow reasonable instructions, protect company resources, and comply with policy. Managers conduct a documented performance review at least annually.
+
+{{company_name}} may use coaching, access restrictions, warnings, reassignment, leave, or separation to address performance or conduct, subject to law and written agreements. It may choose the response suited to the facts and is not required to use a fixed sequence.
+
+Nothing in this handbook limits lawful employee rights.
+
+## Changes and separation
+
+{{company_name}} may revise this handbook as its work, systems, or legal duties change. The policy owner reviews it at least annually. Git history records approvals and changes.
+
+An employee who resigns should give at least two weeks' notice where practical. {{company_name}} may conduct an exit interview. When employment ends, the employee must return company property, records, devices, credentials, and access methods and must not keep company data.
+
+Access is removed under the Information Security Policy. Continuing duties under confidentiality, intellectual-property, and other written agreements remain in effect.
+
+## Acknowledgement
+
+Employees must acknowledge the handbook and assigned policies when they join and when a material update requires a new acknowledgement. An acknowledgement confirms receipt and understanding. It does not create a contract or change lawful employment rights or written employment terms.

package/template/data/policies/policy-information-security.json

@@ -0,0 +1,61 @@
+{
+  "schemaVersion": 1,
+  "id": "policy-information-security",
+  "type": "policy",
+  "title": "Information Security Policy",
+  "status": "draft",
+  "ownerIds": ["person-policy-owner"],
+  "approverIds": ["person-independent-approver"],
+  "policyKind": "information-security",
+  "version": "1.0",
+  "effectiveOn": "{{effective_date}}",
+  "reviewCadence": {
+    "mode": "calendar",
+    "unit": "year",
+    "interval": 1,
+    "anchorDate": "{{effective_date}}"
+  },
+  "audience": ["employees", "contractors", "vendors"],
+  "acknowledgementRequired": true,
+  "relatedPolicyIds": [
+    "policy-clear-desk-screen",
+    "policy-data-protection-handling",
+    "policy-mobile-computing-communications"
+  ],
+  "controlIds": [
+    "control-security-governance",
+    "control-policy-management",
+    "control-security-communication",
+    "control-workforce-expectations",
+    "control-security-training",
+    "control-performance-review",
+    "control-risk-assessment",
+    "control-monitoring-remediation",
+    "control-access-authorization",
+    "control-strong-authentication",
+    "control-access-review-offboarding",
+    "control-physical-workspace-security",
+    "control-data-classification-inventory",
+    "control-encryption-transmission",
+    "control-data-retention-disposal",
+    "control-inventory-configuration",
+    "control-endpoint-protection",
+    "control-network-security",
+    "control-change-management",
+    "control-vulnerability-management",
+    "control-penetration-testing",
+    "control-logging-monitoring",
+    "control-incident-response",
+    "control-incident-exercise",
+    "control-backup-restoration",
+    "control-continuity-exercise",
+    "control-vendor-due-diligence",
+    "control-vendor-monitoring",
+    "control-security-exceptions"
+  ],
+  "relatedDocumentIds": [
+    "document-business-continuity-disaster-recovery",
+    "document-incident-response-plan",
+    "document-data-retention-schedule"
+  ]
+}