ISO 27001 Policy Generator

Example Conversation

You: We need to generate the ISMS policy set for our ISO 27001 certification. We’re a fintech company with 80 employees, running on AWS, subject to UK GDPR, PCI DSS, and FCA regulations.

Agent: I’ll help you build the complete policy set. Let me first check what context is available. Running policy_template_selector…

Recommended generation order:

Priority	Document	ID	Tailoring Notes
1	Information Security Policy	POL-001	Fintech industry; reference UK GDPR, PCI DSS, FCA
2	Document Control Procedure	PROC-007	Define naming convention and approval workflow
3	Risk Management Procedure	PROC-001	Align with risk assessment methodology
4	Corrective Action Procedure	PROC-008	Standard CAPA process
5	Incident Management Procedure	PROC-003	Include GDPR 72h notification, PCI DSS breach reporting
6	Access Control Procedure	PROC-002	Cloud IAM (AWS), SSO via Okta, PCI DSS access requirements
7	Asset Management Procedure	PROC-004	Cloud-first classification scheme
8	Change Management Procedure	PROC-005	CI/CD pipeline, infrastructure as code
9	Business Continuity Procedure	PROC-006	AWS multi-AZ, RTO/RPO targets
10	ISMS Manual	MAN-001	Generate last — references all other documents

Let’s start with POL-001 — the Information Security Policy. I’ll generate it from the template, tailored to your fintech context. Here’s the draft…

You: The policy looks good. Can you validate it?

Agent: Running mandatory_topic_checker on POL-001…

Result: 11/12 mandatory topics covered (92%)

Topic	Status
Purpose and scope	Covered
IS objectives	Covered
Management commitment (Clause 5.1)	Covered
Compliance requirements	Covered
Risk management framework reference	Covered
Roles and responsibilities	Covered
Policy review cycle	Covered
Communication and awareness	Covered
Continuous improvement	Covered
Sanctions for violations	Covered
Alignment with business objectives	Covered
Integration with business processes	Missing

I’ll add a section on how information security integrates with your payment processing and customer onboarding workflows. Running document_metadata_validator…

Result: 8/9 metadata fields present

• Missing: next_review_date — I’ll set it to 12 months from the approval date.

Running terminology_consistency_checker…

• Found 1 issue: Mixed usage of “CISO” and “Head of Information Security” — standardizing to “Head of Information Security” per your org profile.

All validations pass after fixes. Shall I proceed with PROC-007 (Document Control)?

Sample Output Excerpt

Below is a representative excerpt from a generated Information Security Policy showing the document header and key sections.

POL-001 — Information Security Policy (excerpt)

1. Purpose

This policy establishes the framework for managing information security at Acme Payments Ltd. It defines management’s direction and commitment to protecting the confidentiality, integrity, and availability of information assets in accordance with ISO 27001:2022.

2. Scope

This policy applies to all information assets, systems, and processes within the ISMS scope, including the payment processing platform, supporting AWS infrastructure, and all personnel (employees, contractors, and third parties) who access organizational information.

4. Information Security Objectives

Acme Payments Ltd shall pursue the following information security objectives, reviewed annually:

1. Maintain zero critical security incidents affecting customer payment data
2. Achieve and maintain ISO 27001:2022 certification
3. Ensure 100% of employees complete security awareness training annually
4. Maintain platform availability above 99.9% SLA target
5. Remediate critical vulnerabilities within 48 hours of identification

7. Compliance

The ISMS shall ensure compliance with:

• UK GDPR — data protection and privacy requirements
• PCI DSS — payment card industry data security standards
• FCA regulations — financial conduct authority requirements
• ISO 27001:2022 — information security management system standard

Extension Tools

policy_template_selector

Recommends which policies to generate based on available context (organization profile, SoA, risk register). Returns a prioritized list with tailoring notes per policy.

document_metadata_validator

Validates document control fields per Clause 7.5:

Also detects placeholder text ([Organization Name], [YYYY-MM-DD], etc.) in metadata fields.

mandatory_topic_checker

Validates policy content against required topics for its document type. Each of the 10 policy types has a defined set of mandatory topics with regex-based content detection.

Reports:

• Coverage percentage
• Covered topics with matching content
• Missing topics that need to be added
• Auditor expectations for each topic

terminology_consistency_checker

Checks for five categories of inconsistency across policy documents:

Getting Started

Activate the ISO 27001 Policy Generator skill. For best results, complete these skills first:

1. Organization Profile — provides company context for automatic tailoring
2. Risk Assessment — identifies which risks drive procedure requirements
3. Statement of Applicability — determines which control-driven procedures are needed

Have this information ready:

• Your ISMS scope and organizational context
• Names and titles for policy owners and approvers
• Existing policies or procedures that should be incorporated
• Specific regulatory requirements (GDPR notification timelines, PCI DSS controls, etc.)
• Technology stack details for access control and change management procedures

The agent generates documents in dependency order — starting with the Information Security Policy and ending with the ISMS Manual. Each document goes through three automated validations (metadata, mandatory topics, terminology) before finalization.