Creating Policies from Templates

Overview

Rather than writing policies from a blank page, Standardise ships with 27 production-quality ISO 27001 templates — 14 of them policies (Information Security Policy, Access Control Policy, Acceptable Use Policy, and more). Creating a policy is a short, guided flow: pick a template, fill in a few fields, and the content is generated for you, ready to review and approve.

Step 1: Open the Template Picker

Go to Documents in the sidebar and click Create Document. This opens the two-step template picker. On the first screen, templates are grouped by module — switch to the Policies tab (or leave it on All if you're not sure which module you need) to see the full policy list.

Templates you've already created from are greyed out if they're marked singleton (one per organisation — most policies fall into this category, since you only need one Information Security Policy, not several). If you don't want to start from a template, a Blank Document option is always available at the top of the list.

Step 2: Configure the Document

After selecting a template, you'll be asked to:

• Confirm the title — pre-filled from the template name, but you can rename it (useful if you're creating a department-specific variant).
• Assign an owner — the organisation member responsible for keeping the policy current.
• Set a review date — when the policy is next due for review. Most organisations review policies annually.

The module (Policies, Risks, Evidence, etc.) is locked to whatever the template belongs to and can't be changed here.

Placeholder Variables

Template content isn't generic — it's pre-populated with your organisation's details automatically. When the document is created, Standardise resolves placeholders like your organisation name, the document title and reference number, the review date, and the assigned owner's name directly into the generated text, so the policy reads as if it were written specifically for your organisation from the start.

Step 3: Review and Approve

The new policy is created in Draft status. Open it from the Documents table to read through the generated content and edit anything that doesn't match how your organisation actually operates — templates are a starting point, not a final answer. Once you're happy with it, move it through In Review to Approved using the status control on the document detail page. See Document Management for the full approval workflow and version history.

Tips

• Start with the Information Security Policy — most other policies reference it, and auditors typically ask for it first.
• You don't need to create every policy template at once. Add them as your ISMS matures, prioritising whichever controls your Statement of Applicability marks as applicable.
• Editing a policy after approval creates a new version rather than overwriting the approved one, so your audit trail stays intact.