Templates

Confluence policy templates

16 policy packs in 4 categories that ship with Attestation Flow for Confluence. Each page shows the starter text, the acknowledgement settings and the quiz. They are starting points, not legal advice.

How to install them: Attestation Flow for Confluence documentation.

• Information security policy (ISO 27001)

  A top level information security policy written in the shape ISO/IEC 27001 clause 5.2 expects, covering commitments, responsibilities and roles. Everyone with access, contractors included, reads it for at least two minutes, answers two quiz questions and re-attests yearly.

• Acceptable use policy

  For all staff using company devices, accounts, email and internet. It sets must and must not rules, such as using only your own account and never forwarding company data to personal email, with a two question quiz and yearly re-attestation.

• Incident response runbook

  For everyone who may spot a security incident. The runbook walks through report, triage, contain, notify and learn, with a quiz on the first step, seven days to complete and re-attestation every 180 days.

• Bring your own device (BYOD) policy

  For staff using personal phones or computers for work. Devices must be enrolled in device management, kept updated, screen locked and not jailbroken or rooted, and a lost device is reported to IT at once; confirmed yearly.

• Password and authentication policy

  For all staff with company accounts. It requires a unique passphrase per account stored in the password manager, MFA wherever offered, never sharing codes even with IT, and password changes on suspected compromise rather than a fixed schedule.

• Clean desk and clear screen policy

  For office, hot desk and home workers. Staff confirm they lock their screen when away, lock up confidential papers at day end, collect printouts and shred paper, after a minimum 30 second read and a one question quiz, yearly.

• AI usage policy

  For staff using generative AI tools. Only approved tools may be used, personal data, secrets and unapproved source code must never be entered, users own the accuracy of the output, and the pack is re-attested every 180 days.

• Code of conduct (SOC 2)

  For every employee confirming the standards of behaviour that support the SOC 2 control environment criterion on integrity and ethical values. It covers speaking up without retaliation, includes a two question quiz, allows 30 days and repeats yearly.

• Anti-bribery and corruption policy

  For employees and anyone acting for the company. It bans bribes and facilitation payments, limits gifts and hospitality with a register above a set amount, follows UK Bribery Act and FCPA style expectations, and is re-attested yearly.

• Whistleblowing (speak up) policy

  For everyone who may need to report wrongdoing. It lists the channels, including anonymous reporting, commits to acknowledgement within 7 days and feedback within 3 months, and prohibits retaliation, in an EU Directive 2019/1937 style.

• Personal data handling (GDPR)

  For staff who handle personal data. It turns the GDPR principles into everyday rules and says to report a suspected breach immediately, since the controller may have to notify within 72 hours, with a quiz and yearly re-attestation.

• Data retention and disposal policy

  For staff who keep or dispose of company records. It sets a retention schedule for contracts, invoices, employee and recruitment records and logs, stops deletion under a legal hold, and defines secure disposal for paper and electronic data.

• Employee handbook

  For employees confirming they received the handbook on working time, leave, pay, conduct and where to get help. It asks for at least three minutes of reading and one quiz question, and is acknowledged once rather than re-attested.

• Remote work policy

  For staff working away from the office. It covers eligibility, core hours, provided equipment and home security, including the VPN on any network you do not control, with a one question quiz due within 14 days and repeated yearly.

• Health and safety policy

  For employees, managers and management alike. The statement sets out responsibilities, same day reporting of hazards, accidents and near misses, and fire and first aid arrangements, with a two question quiz and yearly re-attestation.

• New starter onboarding pack

  For new starters in their first week, due within seven days. One page links five core policies, asks for MFA on day one and the password manager, names manager, buddy, HR and IT contacts, and is confirmed once.