GRCLibrary.ai

Write a policy

Which policy or template do you need right now?

18 policies and 34 templates in the corpus, across 9 subjects.

The shortest path in the library. Pick a document, adapt it, and keep the cross-references that make it work.

Start

Start from the type

Each row opens a type page listing every document of the type, with its area and purpose: the corpus documents, then the adopter documents of the type under docs/, where it has any. The count beside a row is the type's corpus documents, generated from the taxonomy at build time.

  • Policies18Governing intent and mandatory direction the rest of the corpus implements
  • Templates34Reusable blank skeletons meant to be copied into working instances

Subjects, 9

Or jump to your subject

The domains with at least one policy or template, derived from the taxonomy at build time; the count beside each is the domain's policies and templates, and a subject opens the domain page, every document of the domain on one page.

  • Privacy11Data protection, privacy engineering, and multi-jurisdiction obligations
  • AI8AI governance, assurance, and lifecycle risk controls
  • Security8Information-security controls, architecture, and operations
  • Compliance6Regulatory mapping, control frameworks, and sector audit readiness
  • Governance6Charters, policies, registers, and the programme operating model
  • Resilience5Business continuity, disaster recovery, and incident response
  • Risk5Risk methodology, assessment, and treatment
  • Supply chain2Third-party, vendor, and supply-chain security management
  • Dev security1Secure development lifecycle, CI/CD, and pipeline controls

Operations, Architecture, and Crypto publish no policy or template of their own; documents in each name the policies of other domains among their related documents, and each domain page lists what the domain carries.

Adapt

How to adapt it

Copy the document and replace the organization-neutral values with your own: thresholds, review cadences, and identifiers. Keep the Owner and Approving Authority as roles, and map each role to a real person in a separate private overlay, rather than editing names into the document itself. Read the related standards the policy points to, where it names any; the policy states intent, and the standards carry the requirements an audit will test. Keep the cross-references between them intact, and record your own version and owner on the adapted copy.

Original library content is CC BY-SA 4.0: free to adopt, adapt, and reuse, commercially included; when you share it, give attribution and indicate any changes. If you share an adaptation, license your own contributions under CC BY-SA 4.0, a later CC BY-SA version, or a BY-SA-compatible licence; the library's original content stays under CC BY-SA 4.0, and quotations keep their own licences, as the library's NOTICE file (opens in a new tab) records.