Common policies to help lighten your compliance and operational burden

An AI Agent Governance & Oversight Policy establishes the framework an organization uses to oversee AI agents throughout their lifecycle—from initial evaluation and approval through deployment, monito

An AI Governance and Oversight Policy establishes the framework for how an organization evaluates, approves, deploys, monitors, and governs artificial intelligence systems throughout their lifecycle.

Is an organizational framework designed to prevent unethical practices like bribery, fraud, and embezzlement. It establishes strict rules, guidelines, and controls to ensure legal compliance, corporat

A Code of Conduct defines the standards of workplace ethics, behavior, and integrity that guide your organization. It sets expectations for employees, leadership, and stakeholders—helping businesses f

A Critical Vendor Concentration Risk Policy defines how an organization identifies, evaluates, monitors, and governs dependencies on vendors whose failure or disruption could materially affect the bus

A cybersecurity policy is a formal document that establishes guidelines, rules, and procedures for protecting an organization's digital infrastructure, data, and information systems from cyber threats

A data privacy policy defines how an organization collects, uses, stores, shares, and protects personal and sensitive data. It governs the rules and standards for handling data across systems, teams,

A diversity and inclusion policy defines how your organization fosters an equitable, respectful workplace while meeting compliance expectations.

A Drug and Alcohol Policy helps set clear expectations around substance use while helping HR, compliance, and leadership teams proactively manage risk and uphold workplace standards.

An Enterprise Risk Management (ERM) Governance Policy establishes the framework, responsibilities, and processes used to identify, evaluate, prioritize, and manage organizational risks

Guidelines for business expense reporting, approval, and reimbursement procedures.

A GDPR Compliance Policy defines how your organization handles personal data in alignment with EU privacy regulations.

An IT Acceptable Use policy defines how employees and stakeholders can safely and responsibly use company technology. It’s essential for organizations that want to reduce risk, enforce IT usage standa

An Insider Trading Policy defines how organizations prevent the misuse of material non-public information and ensure compliance with SEC insider trading regulations.

A Non-Disclosure Agreement and Confidential Information Policy defines how your organization protects sensitive information—internally and externally.

A Paid Time-Off (PTO) Policy establishes the rules, processes, and expectations surrounding employee time away from work. It typically governs vacation time, company holidays, personal leave, sick lea

A Performance Management policy is a structured framework that guides goal setting, ongoing feedback, and formal evaluations to align employee work with company objectives. It establishes clear expect

A Record Retention Policy defines how long your organization keeps documents and data, and how they are securely managed throughout their lifecycle.

A Social Media Policy is a formal set of guidelines that defines how employees and representatives of an organization should use social media—both on behalf of the company and in a personal capacity w

A Third-Party AI & Vendor Risk Policy establishes the standards an organization uses to evaluate, approve, monitor, and manage third-party AI providers throughout the vendor lifecycle.

A whistleblower protection policy establishes a safe, structured way for employees and stakeholders to report concerns without fear of retaliation. For modern organizations, it’s essential for maintai

A Workplace Recording Policy defines when and under what circumstances employees may record workplace conversations, meetings, telephone or video calls, interviews, disciplinary proceedings, interacti

An AI Agent Governance and Delegated Authority Policy helps to establish boundaries around what an AI agent is authorized to access, decide, communicate and do on behalf of an organization.

An AI Usage Policy is a set of guidelines that defines how employees and systems within an organization can responsibly, safely, and legally use artificial intelligence tools and technologies.

A Background Check Policy establishes the standards, procedures, and requirements for conducting pre-employment and employment-related screening activities.

A Conflict of Interest policy ensures employees and stakeholders act in the best interest of the organization—not personal gain. It provides clear guidance on identifying, disclosing, and managing con

A Cyber Extortion & Ransomware Decision Policy is a governance framework for how an organization evaluates and responds to ransom demands, data-extortion threats, and related cyber coercion.

A Data Breach Response Policy defines how an organization detects, investigates, contains, and reports security incidents involving sensitive data.

A Deepfake, Impersonation & Digital Identity Fraud Policy establishes an organization’s rules and procedures for identifying, verifying, escalating, and responding to suspected digital impersonation a

A Dress Code Policy is a set of rules established by an organization that outlines acceptable attire, grooming, and personal appearance for its environment. Its primary purpose is to maintain a profes

An Employee Onboarding Policy helps organizations create a consistent, compliant, and engaging experience for every new hire.

An equal employment opportunity policy promotes fair and consistent workplace practices across hiring, promotion, and employee treatment. For organizations committed to diversity and inclusion, it’s a

An Extreme Heat and Worker Protection Policy establishes how an organization identifies, prevents, monitors, and responds to workplace heat hazards.

An anti-harassment policy defines how organizations prevent, identify, and address inappropriate behavior—ensuring a respectful environment for all employees.

An Information Classification Policy defines how an organization categorizes and shares data based on sensitivity, value, and risk.

A Mobile Phone and BYOD (Bring Your Own Device) Policy helps ensure confidentiality, protects trade secrets, and establishes clear guardrails for privacy and responsible device use.

A Right to Disconnect Policy defines an organization's expectations regarding work-related communications and responsibilities outside an employee's normal working hours.

A Password Management Policy defines how your organization creates, stores, and protects credentials—one of the most critical layers of data security.

A Quantum Computing Readiness Policy establishes an organization’s framework for identifying, assessing, governing, and reducing security risks created by advances in quantum computing.

A Remote Work Policy defines how your organization supports work from home while maintaining security and productivity.

A Sustainability Policy defines how your organization manages environmental impact, ethical sourcing, and corporate responsibility.

A travel and entertainment policy ensures your organization manages business travel, client entertainment, and expense management with consistency and accountability. It provides clear business travel

A Workplace Celebration and Social Events Policy establishes expectations for employees and managers participating in company-sponsored or work-related social activities.

A Workplace Violence Prevention policy defines how organizations proactively identify, prevent, and respond to threats in the workplace.