Security Policies & Procedures

You will need to have a number of Policies & Procedures in place to comply with ISO27001.
At the end ISO27001 is a standard for an Information Security Management System – and Audit companies still consider documentation the best evidence. 

Compleye Online is a tool that represents that management system, embedding evidence, not only for security; we have already features in place for privacy and quality as well. However we cannot capture security, privacy and quality just by adding documents – you will need to proof that live up to the policies and procedures that you have adopted. That evidence are called records and you can add these records in Compleye Online. 

However before you can add records, you will need to adopt Policies & Procedures. Mandatory Policy in ISO27001 is: the Security Policy – describing the intentions and ambition (Objectives) you have defined for your ISMS and there are a number of other mandatory topics. We advise you to add in your Security Policy all the Procedures that you will adopt – and review at least yearly. 

In a number of sections we refer to certain templates (procedure/policies/checklists or other documents) and during onboarding of DIY Compleye Online, you will receive the Documentation Toolkit with all the templates. 

Create in your own Documentation Storage a Compliance folder with all Templates you will adopt and make them available for all your team members – that is a mandatory requirement for ISO27001. You can select what documents you will share with Team members in a subfolder. Once you have defined an approved documents, you can add them also to some of the Compleye Online subsection in feature Procedure/Info – to make them easy accessible for your ISMS Team members when needed. 

Below an overview of all Templates in the Documentation Toolkit. 
The section Policies & Procedures is still under development – however you can already upload your adopted and approved documentation with an owner. 

We have tried to keep the documents as simple and short as possible – under the ISO27001 requirement restrictions. So most of them are no longer than 1- 2 pages. 

A good way to start is to assign owners and read the content, customize where needed to your own needs and situation and let them be reviewed by a second person before finally approving them on C-Level. 

Make sure that every document has: an owner, a date of approval and a version (number or date) on it. Store it in your own folder and when this section is ready – add to the list. 

Make sure you will have a control in place to review the documentation on a yearly base. 

More or new templates, checklist can be added to the Toolkit – due to changes in the ISO27001 standard or during certification process with other clients of Compleye. We will then inform you and make those available for you. 

Add new policy