Abdullah Bin Zarshaid

GOVERNANCE · RISK · COMPLIANCE · PRIVACY · AI

GRC Documentation Kit

Original policies, procedures, registers and playbooks for ISO/IEC 27001, ISO/IEC 27701, SOC 2, GDPR, HIPAA and AI governance

Written once, mapped to every framework. 122 documents and 56 Excel registers, with a crosswalk that shows where each control, criterion and article is covered. Markdown you can fork, Word you can sign, Excel you can start filling today. Nothing is copied from any standard; clause and control numbers are cited and the text is the author's own.

Read every document online Download Word and Excel Source on GitHub Author site

MIT licensed, including commercial use · Rebuilt and verified from source on every push · Version 1.0.0

One control set serving ISO 27001, ISO 27701, SOC 2, GDPR, HIPAA and AI governance

Choose a path

ISO/IEC 27001:202216 items plus the shared setScope statement, context, objectives, competence, communication, measurement, the Statement of Applicability with all 93 controls, the control tracker, the 26-week project plan, the audit checklist and the certification journey. ISO/IEC 2770121 itemsPrivacy policy, controller and processor roles, DPIA procedure and template, data subject rights, breach notification, consent and notices, retention, transfers, processing terms, the processing inventory and seven more registers. SOC 212 itemsSOC 2 in plain words, the system description template, the Trust Services Criteria control matrix with every criterion, the evidence calendar, the 100-point readiness checklist, sampling, vendor report review and processing integrity. GDPR20 itemsAn operating model for a product team, the data protection policy, notices for customers, staff and applicants, request letters, consent forms, legitimate interests and transfer assessments, the article map and the gap assessment. HIPAA10 itemsHIPAA in plain words, a privacy policy and a security policy, the required security risk analysis, the breach notification procedure, a business associate agreement, and the Security Rule safeguard matrix with every standard and implementation specification. AI governance11 itemsAcceptable use of AI tools, AI system development and deployment, AI risk assessment with a threat catalogue, vendor and model due diligence, AI incidents, and the inventory and risk registers. Mapped to ISO/IEC 42001, NIST AI RMF and the EU AI Act. Shared by every framework88 itemsThe governance framework, the top-level policy, 27 operating procedures, topic policies, forms and checklists, the audit cycle, the risk method, the readiness questionnaire, the go-live gate, the crosswalk and ten playbooks.

How the documents fit together

Policy, procedure, register and template, record and evidence

The playbooks

ISO/IEC 27001 in twelve steps over 26 weeks

Twelve steps, each with inputs, activities, outputs and the kit documents to use. Read the playbook.

SOC 2 Type 2 readiness in 90 days followed by the observation period

Ninety days to a designed and evidenced control set, then the observation period the auditor samples. Read the playbook.

The personal data lifecycle and the register each scene updates

Each scene in the life of personal data names the register it updates, so the records stay current without a separate compliance project. Read the playbook.

A practical first week

  1. Read PB-01, how to use this kit and pick the path that matches your next audit or customer question.
  2. Fill the readiness questionnaire (60 questions, 10 domains) honestly; every unknown becomes To confirm with an owner and a due date.
  3. Issue the governance framework, the information security policy and the document control procedure, then open the master list of documents.
  4. Build the asset register and run the risk method on your ten most important systems; complete the Statement of Applicability.
  5. Adopt the operating procedures that match your risks, one owner each, and start the evidence calendar.
  6. Book your first internal audit for twelve weeks out. A template is not evidence of compliance; a followed procedure with records is.
What this kit is not.