We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" or base document for different aspects of compliance as they would be defined by common audits such as ISO 27002 or SAS 70. Anyone who has experienced compliance document hell and come out alive... please tell me where you found some help.

  • Thank you ... I wasn't even aware there was such a site, but now I know.
    – Justin Shin
    Nov 17, 2011 at 16:48

3 Answers 3


You can get some good templates from SANS

  • 1
    I've spent the last two years working on PCI compliance. SANS was the single best resource I found, other than literally copying and pasting items from the questionnaire into the language of my internal policies. Nov 17, 2011 at 21:38

disa.mil releases guidelines and checklists for security documentation as well. It's under SRR or STIG, their site is under maintenance at this moment, sorry for no link.


SAS70checklists.com has some good control mapping and compliance templates http://www.sas70checklists.com/tag/templates as does the NIST site itself http://www.nist.gov/index.html

There are a number of software packages that can help automate this process and generate reports. nCircle and IBM are two big players in the compliance management software arena.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .