policies/INDEX.md

Policy and Guidance Index

This page provides a browsable index of all organizational policies and implementation guidance in this repository.

Security

Policies and practical guidance for information security, identity management, data protection, and cybersecurity operations.

Identity, Access, and Authentication

Document	Type	Description
Authentication Policy	Policy	Normative requirements for authenticator assurance levels, MFA, and session management.
Authentication Guidance	Guidance	Practical hardening guidance for authentication systems and services.
Access Control Policy	Policy	Requirements for granting, reviewing, and revoking access to organizational resources.
Access Control Guidance	Guidance	Implementation guidance for role-based access control and least privilege.
Password Policy (Generic)	Policy	System-agnostic password and authenticator policy.
Password Guidance (Generic)	Guidance	System-agnostic password implementation guidance.
Password Policy (Microsoft 365 / AD)	Policy	Microsoft 365 and Active Directory password and authenticator policy.
Password Guidance (Microsoft 365 / AD)	Guidance	Microsoft 365 / Active Directory password implementation guidance.

Data Protection and Classification

Document	Type	Description
Data Classification Policy	Policy	Requirements for classifying organizational data by sensitivity.
Data Classification Guidance	Guidance	Practical guidance for applying data classification labels and handling rules.
Data Retention and Disposal Policy	Policy	Requirements for retaining and securely disposing of data.
Data Retention and Disposal Guidance	Guidance	Implementation guidance for retention schedules and secure disposal methods.

Security Operations

Document	Type	Description
Incident Response Policy	Policy	Requirements for detecting, reporting, and responding to security incidents.
Incident Response Guidance	Guidance	Playbooks and practical guidance for incident handling.
Logging and Monitoring Policy	Policy	Requirements for security logging, monitoring, and alerting.
Logging and Monitoring Guidance	Guidance	Implementation guidance for log sources, SIEM, and detection rules.
Vulnerability and Patch Management Policy	Policy	Requirements for vulnerability identification, prioritization, and remediation.
Vulnerability and Patch Management Guidance	Guidance	Practical guidance for patch deployment and exception handling.
Secrets Management Policy	Policy	Requirements for storing, rotating, and protecting secrets and credentials.
Secrets Management Guidance	Guidance	Implementation guidance for secret vaults, rotation, and injection.

Governance, Risk, and Compliance

Document	Type	Description
Acceptable Use Policy	Policy	Rules for acceptable use of organizational systems, networks, and data.
Acceptable Use Guidance	Guidance	Practical guidance for interpreting and enforcing acceptable use rules.
Vendor Risk Management Policy	Policy	Requirements for assessing and managing risks from third-party vendors.
Vendor Risk Management Guidance	Guidance	Implementation guidance for vendor assessments and due diligence.
Secure SDLC Policy	Policy	Requirements for integrating security into the software development lifecycle.
Secure SDLC Guidance	Guidance	Practical guidance for secure design, coding, testing, and deployment.
Business Continuity and Disaster Recovery Policy	Policy	Requirements for continuity planning and disaster recovery.
Business Continuity and Disaster Recovery Guidance	Guidance	Implementation guidance for continuity plans, backups, and recovery testing.

---

For contribution guidelines and licensing, see README.md.