Could Use Some Work
I liked the policy coverage and organization of topics. I didn't like the number of typos, grammar mistakes and inconstancies between the documents. This project really needs a good editor to make it more useful. Otherwise your customers need to read everything very carefully and correct all your mistakes before using the policies. Some of the content needs an update to include modern technologies (more about 2FA and MFA - including biometrics like finger scans and facial recognition), less about fax machines, PDAs and printer ribbons). The organizational roles are named inconsistently throughout. Discussions of the same topic (e.g., shredding of paper documents) are described differently in different policies. The Information Classification Policy, which in many ways is a core element of this system, needs some more thought and is inconsistent. For example, the four categories listed include one called "UNCLASSIFIED"; however, the descriptions in the following paragraphs refer to "PUBLIC" instead. In which category is PII included? The Information Security Program Policy document says policy documents should be classified as "CONFIDENTIAL - Internal Use Only" but that's not one of the categories and the Information Classification Policy states they should be classified as "PRIVATE". Which is correct? I suggest adding a Roles and Responsibilities section to each policy. This system seems like it was designed for large organizations (based on the number of roles and internal groups described). Please consider adding advice for adapting this system to a smaller organization (e.g., with 10 or fewer staff). Small organizations are expected by their clients to have the same policy coverage as large organizations.
By Marc S.