Changelog

20 October 2026: American spelling, MFA rollout wording, one offboarding deadline, small-team commitments

• The policy templates now use American spelling throughout (organization, authorize, behavior, license), and the Audit Kit's tailoring instructions ask for American spelling in sections 4 and 5.
• When the intake says MFA is not yet enforced for every account, the Information Security, Acceptable Use, Access Control and Authentication policies no longer state that it is in place: they require it for administrative, production and source code access and commit the Security Owner to a dated rollout plan tracked in the risk register.
• While that MFA rollout is under way, the monthly coverage check in the Authentication and Password Policy suspends only the accounts the plan already covers and reports the rest against the plan.
• When source control is answered as Other or no CI/CD tool is named, the Access Control, Asset Management and Business Continuity policies now read as complete sentences instead of phrases such as "the CI/CD pipeline pipelines".
• Offboarding deadlines now agree across the Acceptable Use, Access Control, Human Resources Security and Physical and Remote Work policies: the identity account is disabled by the end of the last working day and all other access is removed within one business day.
• For companies of 1 to 10 people, the Incident Response Policy sets response targets a team without a staffed on-call rotation can meet (for example, a SEV1 is acknowledged within 1 hour instead of 15 minutes), and the Business Continuity and Backup policies point to that on-call arrangement instead of an Engineering on-call rotation.
• Where the Security Owner is the only incident responder, the Incident Response Policy requires the cover schedule to record when they are unavailable and how reports received then are acknowledged and escalated.
• For companies of 1 to 10 people, the four-hour deadline to notify Executive Management of a SEV2 incident now starts when the event is classified as SEV2.
• The Incident Response and Business Continuity policies refer to "the insurer, if any" instead of assuming the company has insurers.
• review-calendar.ics follows the review cadence chosen in the intake: a Quarterly or Semi-annual cadence gets three or six review sessions that repeat every three or six months, instead of eleven one-off monthly sessions, and the README describes the calendar that is built.
• crosswalk.xlsx has a fourth sheet, ISO 27001 Annex A, that maps each of the 93 Annex A controls to the policies that address it and marks the two controls the set does not cover; it is Policyseed's own policy-based mapping, not an official one.
• In registers.xlsx, a hosting or source control answer of Other now produces a row for you to name in the Vendor Inventory and Access Review sheets instead of no row.
• When MFA is not yet enforced for every account, the starter account takeover risk in registers.xlsx lists MFA as required for administrative, cloud and source control access with a dated rollout to every account, matching the policies.
• The annual attestation event in review-calendar.ics now asks you to check this changelog for template changes before re-approving the set.

Policies changed (20): P01 Information Security Policy, P02 Acceptable Use Policy, P03 Access Control Policy, P04 Authentication and Password Policy, P05 Asset Management Policy, P06 Data Classification and Handling Policy, P07 Data Retention and Disposal Policy, P09 Change Management Policy, P10 Secure Software Development Policy, P12 Logging and Monitoring Policy, P13 Incident Response Policy, P14 Business Continuity and Disaster Recovery Policy, P15 Backup and Recovery Policy, P16 Vendor and Third-Party Risk Management Policy, P17 Risk Assessment and Management Policy, P18 Human Resources Security Policy, P19 Endpoint and Workstation Security Policy, P20 Network and Infrastructure Security Policy, P21 Physical and Remote Work Security Policy, P22 Privacy and Data Protection Policy.

Audit Kit: this entry covers kit files beyond the policy text; see the list of kit files.

4 October 2026: Six ISO 27001 Annex A gaps closed

• The 22 policies are now mapped to the 93 ISO/IEC 27001:2022 Annex A controls, with the controls the set does not cover listed and explained.
• The Information Security Policy has the Security Owner follow security advisories from the company's vendors and stay in contact with security communities, and feed what they learn into vulnerability management and the risk assessment (Annex A 5.6).
• The Information Security Policy requires a register of the legal, statutory, regulatory and contractual requirements that affect security, each with an owner, updated when contracts or counsel add one and reviewed with legal counsel at least annually (5.31).
• The Endpoint and Workstation Security Policy adds a repairs procedure: repairs only by the manufacturer or its authorized service providers, with the device wiped first, or its disk encryption confirmed and the user's credentials rotated on return (7.13).
• The Access Control Policy restricts privileged utility programs, such as each platform's root or top-level administrator account and database clients using administrative credentials, to named engineers, never for routine work, with their use logged (8.18).
• The Endpoint and Workstation Security Policy requires browsers to keep their built-in protection against malicious and phishing sites on, plus a DNS or web filtering profile where the MDM tool supports it (8.23).
• The Vulnerability and Patch Management Policy sets rules of engagement for penetration tests and other technical tests of live systems: written approval before they start, scheduling away from peak usage, named contacts who can halt the test, and removal of test accounts and data afterward (8.34).
• With these additions, 91 of the 93 Annex A controls have at least one policy that addresses them, up from 85.

Policies changed (4): P01 Information Security Policy, P03 Access Control Policy, P11 Vulnerability and Patch Management Policy, P19 Endpoint and Workstation Security Policy.

29 September 2026: registers.xlsx added to the Audit Kit

• The Audit Kit includes registers.xlsx, started from your answers: a vendor inventory with a suggested tier per tool, a risk register with ten starter risks whose score and rating compute on the Risk Assessment Policy's scale, the scoring scales, an access review sheet with one row per in-scope system, and a service account inventory.
• The kit README lists the new workbook and its sheets.

Audit Kit: this entry covers kit files beyond the policy text; see the list of kit files.

28 September 2026: Endpoint patch deadline aligned

• The Vulnerability and Patch Management Policy now uses the endpoint deadlines from the Endpoint and Workstation Security Policy: critical and high security updates within 7 days of release (it said 14), all other security updates within 30 days, and devices out of compliance for more than 7 days are blocked from company systems.

Policy changed: P11 Vulnerability and Patch Management Policy.

2 September 2026: First release

• Published the 22 policy templates, P01 to P22, each with nine sections, rendered in the browser from the answers to 23 intake questions.
• Released the Audit Kit: sections 4 and 5 of each policy tailored to your tools, the 22 policies as Word documents and as Markdown, crosswalk.xlsx with the criteria crosswalk, an evidence checklist and policy owners and review dates, a policy acknowledgment form, review-calendar.ics with eleven monthly review sessions and an annual attestation, and a README with 25 questions auditors ask about policies.

Audit Kit: this entry covers kit files beyond the policy text; see the list of kit files.