security-policy-drafting
Use this for a first policy set, or to replace a template pack that nobody follows. You get a set of draft documents in a new folder, ./security-policy-drafting/: a one-page map of which policies exist, who owns each and who reads it (policy-map.md); the main security policy, two to four pages for every employee (top-level-policy.md); one short policy per topic, such as access or backups, in a subfolder (topics/); and a list of the commitments leadership must decide on before signing (open-decisions.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Leadership approves the policies; the agent never does.
Inputs to gather
Read what exists: current policies or templates, the scope statement, risk register, asset and vendor lists, customer contracts with security clauses, answered questionnaires and audit findings. Then ask the reader, in one message: headcount and locations, what the company sells and what customers trust it with, which frameworks or laws are in scope, who will approve the policies, and who can own each area (engineering, IT, people, legal, operations).
Step 1: size the policy set before writing a word
Draw the policy map (policy-map.md) first: each policy, its owner role, its audience, what it covers and the control ids from the company's control set or applicability statement it supports. Rules of thumb:
- One policy per owner who will keep it alive. A policy without an owner role rots.
- Under 50 people: the top-level policy plus 6 to 10 topic policies, merging where one owner covers several topics (identity and access with endpoint use; operations with change and backup).
- 50 to 250 people: 10 to 15 topic policies, split where owners differ.
- Larger or regulated companies: split only where audiences differ.
Then run a framework lookup for each framework in scope to confirm which topics it expects to see documented, and record the answer per topic in the map. Do not start from a framework's control list and write one policy per item; that is how 40-document packs happen.