Skip to content

Policy Library Guide (compliance/policies/)

compliance/policies/ (repo root, alongside compliance/snapshots/ and compliance/restore-drills/) is the client's written policy library — the management documents that every framework mapping marks 📋 Manual (e.g. SOC 2 CC1.1/CC2.2, ISO 27001 A.5.1/5.2, HIPAA 164.316(a)). SnowOps automation proves controls operate; it does not write the policies that describe them — auditors require both. See the Compliance Engagement Guide §2 Step 5 (Auditor Readiness Checklist) for where this fits in the overall flow.

Automation status: the Policy Repo Template (V1 in the Asset Glossary) will manage this library (markdown library + PR-signed amendment workflow + Vanta acknowledgment sync) but is postponed to M4 (see Project State). Until V1 ships, populate compliance/policies/ by hand using the structure below — V1 will be able to ingest an existing tree without rework if you follow it now.

Minimum policy set (cross-framework)

Each file should be a single markdown doc: purpose, scope, policy statements, roles/responsibilities, review cadence, and a version/approval log (table of date, version, approver, change summary — this is the evidence an auditor will ask for).

File Required by Notes
infosec-policy.md SOC 2 CC1.1, ISO 27001 A.5.1/5.2, HIPAA 164.316(a) Top-level information security policy; references the others below
acceptable-use-policy.md ISO 27001 A.5.10 What employees may/may not do with company systems
incident-response-policy.md SOC 2 CC7.4/CC7.5, ISO 27001 A.5.24–A.5.27, HIPAA 164.308(a)(6) Pairs with the Incident Response Runbooks (K1) library — this is the policy; K1 is the procedure
business-continuity-dr-policy.md SOC 2 A1.3, ISO 27001 A.5.29/5.30, HIPAA 164.308(a)(7) References Azure Backup Policy Module (L1)/Cross-Region Replication Module (L2)/Automated Restore Drill (L4) evidence (DR runbooks, backup policy, replication, restore drills) as the technical implementation
change-management-policy.md SOC 2 CC8.1, ISO 27001 A.8.32 References Pre-Commit Quality Hooks (D1)/Terraform Plan/Apply Pipeline (C1)–GitOps Branching Standard (C4) (branch protection, CI gates, PR review) as the technical implementation
vendor-management-policy.md SOC 2 CC9.2, ISO 27001 A.5.19/5.20 Vendor register + due-diligence + DPA/BAA tracking (manual until P-series ships, M4)
password-authentication-policy.md CIS Azure 1.1–1.3, HIPAA 164.308(a)(5)(ii)(D) References Break-Glass Account Module (H7)/Azure Baseline Module (F1) (break-glass, OIDC, no passwords in pipelines)
data-classification-retention-policy.md SOC 2 C1.1/C1.2, ISO 27001 A.5.12, HIPAA 164.310(d) References Azure Backup Policy Module (L1) retention + Audit Log Archive Module (J6) WORM as the technical backstop

Framework-specific additions

  • HIPAA only: baa-tracker.md (Business Associate Agreements — sign Microsoft's BAA before storing ePHI), sanction-policy.md (164.308(a)(1)(ii)(C)), emergency-mode-operation-plan.md (164.308(a)(7)(ii)(C)), workstation-use-security-policy.md (164.310(b)/(c)).
  • ISO 27001 only: isms-scope.md (clause 4.3), statement-of-applicability.md (clause 6.1.3 — use the ISO 27001 control mapping as the technical input), risk-treatment-plan.md (clause 8.3, fed by Discovery Audit Suite (G0–G7) findings).
  • SOC 2 only: code-of-conduct.md (CC1.1), breach-notification-procedure.md (CC7.5).

Naming and versioning convention (for V1 forward-compatibility)

  • One markdown file per policy, kebab-case, matching the table above where applicable.
  • Each file starts with a front-matter-style header block: Owner, Approved by, Approval date, Next review date, Version.
  • Amendments go through a normal PR (this is the "PR-signed amendment workflow" V1 will formalize) — the git history of this directory is the audit trail until V1 lands.
  • Do not delete superseded versions; bump the version and log the change in the in-file approval log table — auditors expect to see the revision history.

What this directory is not

  • Compliance Engagement Guide — where the policy library fits in the overall engagement flow (Step 5, Auditor Readiness Checklist)
  • SOC 2 / ISO 27001 / HIPAA control mappings — the 📋 Manual rows that drive this policy set, each with a "What SnowOps Does NOT Automate" table
  • Asset Glossary — V1 (Policy Repo Template), and every other asset code referenced above
  • Incident Response and Disaster Recovery runbooks — the operational procedures the IR/BCP policies above should reference