Skip to content

V1 — Policy Repo Template — Test Runbook

Asset: V1 — security policy templates (templates/policies/): Information Security, Acceptable Use, Incident Response, Business Continuity & DR, Change Management, Vendor Risk. Owner: CO · Milestone: M4. Documentation asset — verification is the offline gate + a content review.

Part A — Offline gate (~2 min, $0)

python3 templates/policies/validate.py

Acceptance: - [ ] Reports all 6 policy templates valid. - [ ] Each policy carries the standard skeleton (Purpose · Scope · Policy statements · Roles & responsibilities · Enforcement · Exceptions · Review) and the metadata placeholders ({{CLIENT_NAME}}, {{POLICY_OWNER}}, {{EFFECTIVE_DATE}}, {{REVIEW_CADENCE}}). - [ ] Every relative cross-link (into docs/runbooks/, waivers/, apps/, etc.) resolves on disk — the gate fails closed on a dangling link, so a renamed asset can't silently rot a policy's "operationalized by" reference.

Part B — Content review (~6 min, $0)

  • Each policy's Enforcement section maps the document control to the SnowOps assets that actually operationalize it (e.g. IR → K1–K5/J3/J4; Change → R1–R4/C1–C3/D3/D5; BC/DR → L1/L2/L4/L5). Spot- check two against docs/context/00-asset-glossary.md.
  • The policies satisfy the 📋 Manual document controls the control mappings flag (e.g. SOC 2 CC1.1 / CC2.2) — cross-check a couple against docs/compliance/soc2-control-mapping.md.
  • Adoption flow in templates/policies/README.md is followable: copy → fill placeholders → ratify (record approver+date) → review on cadence.

Part C — Adoption dry-run (optional, ~10 min, $0)

  • Copy templates/policies/ into a scratch client policy repo, fill the placeholders for a fictional client, and confirm the result reads as a ratifiable policy set (no leftover {{PLACEHOLDERS}}).
  • Feed the filled policies + their enforcing assets to the Compliance Manual Generator (V4) and confirm they appear as the policy references per control.

Notes

  • These are templates, not legal advice — counsel + the accountable owner review before ratification (stated in the README).
  • The pack is intentionally the document half of the control set; the automated half is the SnowOps modules/apps each policy's Enforcement section cites.