Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" or base document for different aspects of compliance as they would be defined by common audits such as ISO 27002 or SAS 70. Anyone who has experienced compliance document hell and come out alive... please tell me where you found some help.

share|improve this question

migrated from Nov 17 '11 at 16:55

This question came from our site for system and network administrators.

Thank you ... I wasn't even aware there was such a site, but now I know. – Justin Shin Nov 17 '11 at 16:48
up vote 5 down vote accepted

You can get some good templates from SANS

share|improve this answer
I've spent the last two years working on PCI compliance. SANS was the single best resource I found, other than literally copying and pasting items from the questionnaire into the language of my internal policies. – Tim Brigham Nov 17 '11 at 21:38 releases guidelines and checklists for security documentation as well. It's under SRR or STIG, their site is under maintenance at this moment, sorry for no link.

share|improve this answer has some good control mapping and compliance templates as does the NIST site itself

There are a number of software packages that can help automate this process and generate reports. nCircle and IBM are two big players in the compliance management software arena.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.