تُرجمت هذه الصفحة وتم التحقق منها آليًا. النسخة الإنجليزية هي المرجع. بعض الأجزاء لا تزال بالإنجليزية ريثما يتم التحقق من ترجمتها. عرض بالإنجليزية · الإبلاغ عن خطأ في الترجمة
خمسة وأربعون نموذجًا للسياسات والمعايير، جاهزة للاعتماد في مؤسستك.
هذه نماذج لبرنامجك الخاص، وليست قواعد الجمعية: مكتبة أساسية كاملة من وثائق الأمن والخصوصية والبيانات والعمليات تتضمن حقولًا قابلة للدمج، فتملأ أسماء مؤسستك وتعتمدها وثائق خاصة بك. خمسة منها مشمولة في العضوية المنتسبة. اطّلع على معاينة أي منها، ونزّل ما يشمله مستواك.
سياسة الاستخدام المقبول
[POLICY] [SME] Personnel-facing rules of acceptable system, data, and resource use; includes GenAI use boundaries.
Version 2026.07 · updated Jul 2026
Previewسياسة الاستخدام المقبول للذكاء الاصطناعي
[POLICY] [SME] Responsible use of AI/ML and generative tools: approved use, data-handling limits, human accountability. NIST AI RMF, ISO 42001, EU AI Act.
Version 2026.07 · updated Jul 2026
Previewمدونة السلوك
[POLICY] [SME] FCPA, UK Bribery Act, SOX, Dodd-Frank, EU Whistleblower Directive; ethics and compliance framework.
Version 2026.07 · updated Jul 2026
PreviewIT Security Policy
[POLICY] [SME] Master IT Security Policy — apex of the policy library; foundational organisational commitment to information security.
Version 2026.07 · updated Jul 2026
PreviewInfoSec Roles and Responsibilities Policy
[POLICY] [SME] Consolidated role allocation, 25-row RACI, Three Lines Model.
Version 2026.07 · updated Jul 2026
PreviewAccess Control Policy
[POLICY] [SME] Policy-level commitment to least privilege, need-to-know, separation of duties; parent of STD-001/STD-002.
Version 2026.07 · updated Jul 2026
PreviewData Management Policy
[POLICY] [SME] Data classification, handling, retention, sanitisation commitment; parent of REF-001 and REF-003.
Version 2026.07 · updated Jul 2026
PreviewGlobal Data Privacy Policy
[POLICY] [SME] GDPR Articles 1-99, all US state privacy laws, multi-jurisdictional privacy framework.
Version 2026.07 · updated Jul 2026
PreviewHuman Resource Security Policy
[POLICY] [SME] JML discipline, awareness training, sanctions process, contractor governance.
Version 2026.07 · updated Jul 2026
PreviewCryptography Policy
[POLICY] [SME] Foundational commitment to cryptographic controls; parent of STD-005.
Version 2026.07 · updated Jul 2026
PreviewIncident Response Plan
[POLICY] [SME] Policy-level IR capability commitment; parent of STD-012; SEC 8-K 4-day disclosure.
Version 2026.07 · updated Jul 2026
PreviewAsset Management Policy
[POLICY] [SME] Inventory across hardware, software, cloud, data; SBOM integration; ownership accountability.
Version 2026.07 · updated Jul 2026
PreviewOperations Security Policy
[POLICY] [SME] Operational discipline including patching cadence (Critical 15d / 72h KEV).
Version 2026.07 · updated Jul 2026
PreviewPhysical Security Policy
[POLICY] [SME] 4-tier facility zones, access control, environmental protections, logical-physical integration.
Version 2026.07 · updated Jul 2026
PreviewChange Management Policy
[POLICY] [SME] Policy-level change governance; parent of STD-016; DORA Change Failure Rate.
Version 2026.07 · updated Jul 2026
PreviewCloud Security Policy
[POLICY] [SME] Policy-level cloud security commitment; parent of STD-007; CSA CCM v4, EU DORA.
Version 2026.07 · updated Jul 2026
PreviewApplication Logging Guideline
[GUIDELINE] [SME] Engineering how-to for structured logging; supports STD-022; language-specific patterns.
Version 2026.07 · updated Jul 2026
PreviewApproved Technology Catalogue
[REFERENCE] [SME] 15-category framework, 6-status taxonomy, AI/ML and GenAI tool governance, EU AI Act.
Version 2026.07 · updated Jul 2026
PreviewData Classification Reference
[REFERENCE] [SME] 4-tier classification framework, per-classification handling, GDPR Article 9, CPRA SPI.
Version 2026.07 · updated Jul 2026
PreviewRecords Retention Schedule
[REFERENCE] [SME] Retention by record category, HIPAA 6yr, PCI 1yr, SOX 7yr, GDPR retention limitation, legal hold.
Version 2026.07 · updated Jul 2026
PreviewInformation Security Governance Policy
[POLICY] [SME] Foundational governance principles; parent of STD-015; ISO 27014, NIST CSF GV.
Version 2026.07 · updated Jul 2026
PreviewRisk Management Policy
[POLICY] [SME] ERM framework, NIST CSF 2.0 GV/ID, 5×5 risk matrix, risk acceptance authority.
Version 2026.07 · updated Jul 2026
PreviewIT Security Risk Management Policy
[POLICY] [SME] IT-specific risk discipline; risk register operations; Board risk reporting.
Version 2026.07 · updated Jul 2026
PreviewThird-Party Management Policy
[POLICY] [SME] Vendor risk assessment, contractual flow-down, monitoring; NIST 800-161 R1, EU DORA 28-44.
Version 2026.07 · updated Jul 2026
PreviewInsider Risk Management Policy
[POLICY] [SME] Insider threat governance; CNSSD 504 alignment; worker-monitoring boundary.
Version 2026.07 · updated Jul 2026
PreviewSecure Development Policy
[POLICY] [SME] Commitment to secure development; parent of STD-019 and STD-020; NIST SSDF, SLSA.
Version 2026.07 · updated Jul 2026
PreviewBusiness Continuity and Disaster Recovery Plan
[POLICY] [SME] Operational resilience policy framework; parent of STD-023; EU DORA, NIS 2.
Version 2026.07 · updated Jul 2026
PreviewPolicy templates provided by a sponsor of the association.