Policy Index

The Partile policy layer: a lean, relevant set of policies shaped to ISO/IEC 27001:2022 and the SOC 2 Trust Services Criteria, sized for a small, fully-remote, early-production software company. Policies state the rule; procedures (../procedures/) state how; the control register (../control-register.md) records whether it is actually true.

A drafted policy supports a designed control. It does not by itself make a control implemented, verified, or operational — that needs evidence the process operates. Most policies below are draft: the rule is written and reflects intended practice, but Partile is pre-beta with no real users.

Status legend (policy lifecycle)

Status	Meaning
draft	Written; reflects intended practice; not yet formally adopted/operating.
adopted	In force and demonstrably followed by current project practice.

Standard policy header

Every policy carries this header: Status, Owner (role), Applies to (scope), Review cadence, Mapped controls, Evidence, Exception handling. Owners are roles (DIR / INFRA / OPS / MOBILE / COUNSEL), not people.

Policies

Policy	Status	Owner	Primary controls
information-security-policy.md	draft	DIR	GOV-01, GOV-03, SEC-*
risk-management-policy.md	draft	DIR	GOV-01, all (risk basis)
access-control-policy.md	draft	INFRA/DIR	SEC-01–04, SEC-12
acceptable-use-and-device-policy.md	draft	DIR	SEC-05, SEC-08
secure-development-policy.md	draft	INFRA	SEC-01–06, SEC-15, OPS-04
change-management-policy.md	adopted	DIR	OPS-04, GOV-01, GOV-03
vulnerability-management-policy.md	draft	OPS/INFRA	SEC-10, SEC-14, SEC-15
incident-response-policy.md	draft	DIR/COUNSEL	SEC-13, SEC-11
data-classification-and-handling-policy.md	draft	DIR	PRIV-06, SEC-05, SEC-06, ML-04
cryptography-and-secrets-policy.md	draft	INFRA/OPS	SEC-01, SEC-05, SEC-08
backup-and-recovery-policy.md	draft	OPS	OPS-01, OPS-03
vendor-and-subprocessor-policy.md	draft	DIR/COUNSEL	GOV-02, PRIV-11
privacy-and-retention-policy.md	draft	DIR/COUNSEL	PRIV-01–12, SEC-12
security-awareness-policy.md	draft	DIR	GOV-01 (people)
ai-ml-data-governance-policy.md	draft	DIR/INFRA	ML-01–10, PRIV-10
not-applicable-controls.md	designed	DIR	physical/office scope-outs

Procedures (operational detail)

Procedure	Supports policy
../procedures/access-review-procedure.md	access-control
../procedures/onboarding-offboarding-procedure.md	access-control, security-awareness
../procedures/incident-response-playbook.md	incident-response
../procedures/vulnerability-triage-procedure.md	vulnerability-management
../procedures/release-review-procedure.md	change-management, secure-development

Maintenance

Policies are reviewed annually or on material change to the systems/risks they govern (whichever comes first); the change-management policy review is triggered per-PR via the control-register upkeep rule. New systems or vendors trigger a review of the relevant policy before go-live. All policy changes are version- controlled — Git history is the change record.