Customers, insurers and auditors ask small companies for written security policies long before those companies have a security team. Downloading generic templates is free, but a template that describes controls you do not have is worse than no policy: it is a written promise you are breaking. This service writes policies that match what you actually do today, with clear notes where you may want to do more.
What’s included
Core 5, $99
- Information security policy (the umbrella document)
- Access control policy
- Incident response policy
- Acceptable use policy
- Data classification policy
Delivered in 4 business days, with one round of revisions.
Set of 12, $199
The core 5, plus:
- Risk management policy
- Vendor and third-party management policy
- Business continuity and disaster recovery policy
- Change management policy
- Encryption policy
- Logging and monitoring policy
- Patch and vulnerability management policy
Delivered in 5 business days, with two rounds of revisions.
Every policy comes in editable Word and as PDF, with an owner, a review date and a version table filled in, plus a one-page cover note listing any place where the policy describes something you told us you do not yet do, so you can decide whether to fix the gap or soften the wording.
What we need from you
- The completed intake form, which we email after you order. It takes about 20 to 30 minutes and asks how many people you have, where data lives (which cloud and SaaS tools), how people log in (MFA, single sign-on, shared accounts), how devices are managed, how backups work, and who handles incidents.
- Your company name and the names or roles of policy owners.
- If a customer or insurer asked for these policies, the exact wording of their request, so the set matches what they asked for.
- Any existing policies you want kept or replaced.
Turnaround
4 business days for the core 5 and 5 business days for the set of 12, starting when we have the completed intake form and payment. Revisions come back within 2 business days of your comments.
Scope
Included
- Policies for one organization, tailored to the intake answers.
- One revision round (core 5) or two (set of 12).
Not included
- Implementing the controls the policies describe.
- Procedures, runbooks or technical standards for specific systems.
- Mapping to every control in a framework such as SOC 2, ISO 27001 or HIPAA. We can note where a policy relates to common framework areas, but that is not a compliance mapping.
- Logging into your systems to check what you told us.
Who does the work
Emilio Santos does the work, with AI assistance. He uses general-purpose AI tools to help sort, draft and check, which means parts of what you send are processed by those tools. He reads every line of what you send and every line of the deliverable before it goes to you.
Your data
- Send files by email to circuits50capital@circuits.fit. They arrive and are stored in that mailbox.
- Please remove passwords, keys, account numbers, payment card numbers and protected health information before sending. We never ask for system access or credentials.
- Parts of your material are processed by AI tools as part of the work. Where a tool’s settings let us turn off the use of our inputs for model training, we turn it off, and we do not use your files to train models.
- We delete your files and our working copies within 30 days of delivery. Copies kept by email or AI providers under their own retention or backup schedules may last longer, and we do not control those.
- We do not sell or share your material except with the email and AI services used to receive and process it. See the privacy policy. If you would rather your material not be processed by AI tools, say so when you order and we will tell you whether we can do the work without them.
How to order
- Email circuits50capital@circuits.fit with the subject "Security Policy Set" and a short description. You can attach files now or after we reply.
- We confirm the scope with you by email.
- Payment is arranged after the scope is confirmed. The turnaround starts once payment is in.
After the scope is confirmed by email, you’ll be sent a secure Stripe card payment link.
FAQ
Will these policies make us SOC 2 or ISO 27001 compliant?
No. Policies are one part of those programs. An auditor will test whether you follow them, which depends on your controls, not on the documents.
Can I start with 5 and add the rest later?
Yes. Email us when you are ready and we will confirm the price for the remaining 7 before any work starts.
Are these just templates?
They start from our own standard structure and are rewritten to match your answers. Where you tell us you do not do something, the policy says so or the cover note flags it.
Do you offer this to MSPs for their clients?
Yes. Each client organization is a separate order, and we can leave our name off the documents. Say so when you order.
Can I track exceptions to these policies?
Yes. The free risk exception register records each exception, its owner and expiry.
Disclaimer
Templates tailored to your answers. Adopting them doesn’t make you compliant with any framework or law, and this is not a certified audit or legal advice.
Circuit & Capital services are research, writing and advisory deliverables prepared with AI assistance and reviewed by Emilio Santos before delivery. They are not legal, tax, accounting, audit or compliance-certification services, and no attorney-client, auditor or fiduciary relationship is created. You decide what to act on and remain responsible for your contracts, deadlines, security controls, filings and submissions. Our total liability for any order is limited to the fee paid for that order. If a deliverable doesn’t match its published scope, tell us within 14 days and we’ll fix it or refund it.