Policy & Evidence Library
This page lists the reusable security policy documents and evidence attachment names maintained in this wiki. Customer-specific cloud data, project trackers, raw questionnaires, and environment evidence are not stored here.
| Policy / evidence document | Purpose | Wiki route |
|---|---|---|
| Information Security Policy | Security governance, roles, review cadence, security objectives | security/01-information-security-policy |
| Security Risk Management Policy | Risk identification, rating, treatment, and ownership | security/02-security-risk-management-policy |
| Data Privacy and DPDP Policy | Privacy principles, DPDP commitments, data-subject support | security/03-data-privacy-dpdp-policy |
| Data Processing Agreement / DPDP Addendum Template | Processing roles, scope, security obligations, confidentiality | security/04-data-processing-agreement-dpdp-addendum |
| Document Request and Secure Data Exchange SOP | Approved document request and secure exchange process | security/05-document-request-process-sop |
| Encryption Standard | Encryption in transit, at rest, credential and key protection | security/08-encryption-standard |
| Key Management Procedure | Key inventory, storage, access, rotation, revocation | security/09-key-management-procedure |
| Vulnerability Management Policy | Vulnerability intake, triage, remediation, validation, reporting | security/10-vulnerability-management-policy |
| Vulnerability Remediation SLA Matrix | Severity definitions and remediation timelines | security/11-vulnerability-remediation-sla-matrix |
| VAPT / Penetration Test Executive Summary Template | Standard summary structure for VAPT evidence | security/12-vapt-executive-summary-template |
| Secure SDLC Policy | Secure requirements, coding, review, testing, release practices | security/13-secure-sdlc-policy |
| Asset Management Policy | Asset inventory, ownership, lifecycle, disposal | security/14-asset-management-policy |
| Acceptable Use Policy | Approved/prohibited use and customer data handling | security/15-acceptable-use-policy |
| Information Classification and Handling Policy | Classification levels and handling matrix | security/16-information-classification-and-handling-policy |
| Data Retention and Disposal Policy | Retention schedule, secure deletion, customer exit | security/17-data-retention-and-disposal-policy |
| Identity and Access Management Policy | Provisioning, least privilege, privileged access, service accounts | security/18-identity-and-access-management-policy |
| Password Policy | Password requirements, MFA, default passwords, storage | security/19-password-policy |
| Network Security Policy | Segmentation, perimeter controls, admin access, firewall review | security/20-network-security-policy |
| Network Architecture Diagram Evidence Requirements | Required components, boundaries, flows, annotations | security/21-network-architecture-diagram-description |
| Endpoint Security and Hardening Policy | Endpoint baseline, antivirus/security tooling, hardening | security/22-endpoint-security-hardening-policy |
| Patch Management Policy | Patch sources, prioritization, testing, deployment | security/23-patch-management-policy |
| Change Management Policy | Change types, approvals, deployment validation | security/24-change-management-policy |
| Cloud Security Standard | Cloud governance, IAM, network, encryption, logging, backup controls | security/25-cloud-security-standard |
| Business Continuity and Disaster Recovery Policy | BIA, RTO/RPO, backups, recovery, testing | security/26-business-continuity-disaster-recovery-policy |
| Incident Response Plan | Incident categories, severity, lifecycle, roles | security/27-incident-response-plan |
| Logging, Monitoring and Log Retention Policy | Log sources, retention, protection, monitoring | security/28-logging-monitoring-log-retention-policy |
| HR Security Policy | Pre-employment, onboarding, employment, offboarding | security/29-hr-security-policy |
| Background Verification Process | Applicability, checks, consent, exception handling | security/30-background-verification-process |
| NDA / Confidentiality Agreement Structure | Confidential information, use limitation, non-disclosure | security/31-nda-confidentiality-template |
| Security Awareness Training Evidence Structure | Audience, topics, frequency, training records | security/32-security-awareness-training-evidence |
| Secure Coding Training Evidence Structure | Developer security training topics and records | security/33-secure-coding-training-evidence |
| Physical Security Policy | Premises access, visitors, device/document protection | security/34-physical-security-policy |
| Vendor / Subprocessor Management Policy | Vendor classification, onboarding, contracts, review | security/35-vendor-subprocessor-management-policy |
| Subprocessor Register Template | Register fields, approval workflow, review cadence | security/36-subprocessor-register |