Cyber Policy Wizard Beta

Answer a few questions about your organization and generate tailored, NIST-aligned information security policies entirely in your browser with no data stored

1
Org Info
2
Personnel
3
IT Systems
4
Regulations
5
Settings
6
Policies
7
Generate

Organization Information

Used wherever policies reference [Entity] or [entity].

Key Personnel & Roles

These names and titles will be inserted into policy ownership, authority, and responsibility sections.

Executive / Security Leadership
IT Operations
Support Contacts
External IR Resources

Vendor and external contact details referenced in the Incident Response Policy. Leave blank if not applicable to your organization.

IT Environment & System Scope

Select the system types present in your organization. Click a tile to select it, then check the specific technologies that apply to you. You don't need every item listed — they're just examples of what falls under each category. Hover the ? on any tile for guidance on whether it applies to you.

Applicable Regulatory Frameworks

Select all regulatory requirements and frameworks applicable to your organization. Compliance-specific language, required controls, and notification obligations will be added as addenda to the appropriate policies.

Healthcare
Health Insurance Portability and Accountability Act — required for any org handling PHI. Adds Security Rule, Privacy Rule, and Breach Notification requirements.
Financial
Payment Card Industry Data Security Standard — required for any org storing, processing, or transmitting cardholder data.
Required for US public companies. Adds IT General Controls (ITGCs), audit trail requirements, and financial system access controls.
Required for financial institutions. Adds Safeguards Rule requirements for customer financial information protection.
Federal / Defense
Federal Information Security Modernization Act — required for federal agencies and contractors handling federal information.
Federal Risk and Authorization Management Program — required for cloud service providers serving federal agencies.
Cybersecurity Maturity Model Certification — required for DoD contractors handling Controlled Unclassified Information (CUI).
Privacy
EU General Data Protection Regulation — applies to any org processing EU residents' personal data. Adds 72-hour breach notification, DPO, and data subject rights requirements.
California Consumer Privacy Act — applies to orgs meeting threshold criteria handling California residents' personal information.
Family Educational Rights and Privacy Act — required for educational institutions handling student education records.
Frameworks & Certifications
AICPA Service Organization Controls — voluntary certification demonstrating security, availability, processing integrity, confidentiality, and privacy controls.
NIST CSF 2.0 — widely adopted voluntary framework aligned to Identify, Protect, Detect, Respond, and Recover functions.
International standard for Information Security Management Systems (ISMS). Adds Annex A control alignment and certification audit requirements.
State & Other
New York Department of Financial Services — applies to NY-licensed financial entities. Specific CISO, penetration testing, and MFA requirements.
NERC Critical Infrastructure Protection — required for electric utilities. Adds bulk electric system cybersecurity requirements.

Policy Configuration

Set organization-specific parameters that will be embedded into policy language throughout all generated documents.

Training & Testing Frequencies
Account & Access Controls
Incident Response Parameters
Data Classification Labels
Incident Classification & Response Authority

Define reportable incident types, severity thresholds that trigger IRP activation, and who holds communication authority during major incidents.

Event types that constitute a reportable security incident:

Response Communication Authority:

Data Retention

Set minimum retention periods by record category for the Data Retention Policy. Regulatory minimums (based on Step 4 selections) are noted in the labels.

Select Policies to Generate

Choose the policies you need. All are based on NIST SP 800-53 control families. Hover the ? next to each policy name for a description of what it covers, who needs it, and which regulations require it.

Governs appropriate use of IT resources and user responsibilities.
NIST AC — account management, access enforcement, privileged access.
CCERT/DCERT structure, threat reporting, and escalation procedures.
End-to-end IR process, stakeholder roles, severity levels, and metrics.
NIST IA — MFA, identifier management, authenticator requirements.
NIST IR — training, testing, handling, monitoring, and reporting.
Umbrella policy — program governance, risk management, responsibilities.
Risk framing, assessment, response, and monitoring framework.
NIST RA — security categorization, risk assessment, vulnerability scanning.
NIST CA — security assessments, system interconnections, continuous monitoring.
NIST AT — awareness training, role-based training, phishing simulation.
NIST SA — acquisition requirements, SDLC security, supply chain.
Retention schedules by data category, regulatory minimums, legal hold, and secure disposal.

Generate Your Policies

or download individually above