Our new startup is required to jump through hoops in order to get authorization to use Experian. We are working out of WeWork (shared space). No experian data is stored on our local machines.

We do have a web application server and a database on AWS.

They are asking for our "Information Security Policy". What should be the scope of that? IS there any template we can use that'll satisfy them?


There are many templates that can help you design your own policies. The international standard is ISO 27002. There are numerous templates you can find via Google but it might be helpful to get a professional to help you out.

But as for what the minimum will be for Experian, you might have to ask them, or hire a QSA. It is not clear from your question if the requirement is a general corporate Information Security Policy, or one focussed on PCI/EI3PA requirements.

The short answer is: you might have to hire a consultant for a short time or work closely with Experian.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.