Free tools from Preferred Data
Free Business Policy Templates and Generators
A policy template is a starter document you adapt into your organization's own policy. Our free generators let you read every template in full first, then answer a short set of questions and download a finished PDF with version tracking and a scheduled review date. Policy choices start at a suggested setting, and you answer the facts about your organization yourself.
Which policy template do you need?
Each template opens on a page with the complete sample policy, the frameworks it aligns with and answers to common questions. Build your own version when you are ready.
Artificial intelligence
AI Governance Policy Template
Set how your organization approves, uses, oversees and audits AI tools, aligned to the NIST AI Risk Management Framework.
AI Acceptable Use Policy Template
Give every employee clear, signable rules for using ChatGPT, Copilot, Gemini and other AI tools at work without exposing company or customer data.
Cybersecurity
Information Security Policy Template
Establish the core security program every insurer, auditor and customer now asks about: data classification, access control, patching, encryption, logging and vendor risk.
Incident Response Plan Template
Know exactly who does what in the first hours of a ransomware attack, data breach or business email compromise, including who to call and which notification clocks start.
Password and MFA Policy Template
Modern password and MFA rules based on current NIST SP 800-63B guidance: long passphrases, a password manager, no forced resets, and phishing-resistant MFA where it matters.
Wire Transfer Verification Policy Template
Stop fake invoices and email payment fraud with simple rules: call back on a known number before any bank change, two approvers for large payments, and no payment changes by email alone.
Access Control Policy Template
Give people only the access they need, protect every sign-in with MFA, keep admin accounts separate, review access every quarter and remove it the moment someone leaves.
Security Awareness Training Policy Template
Decide who gets cybersecurity training, when, how phishing tests work, and which training records you keep for insurers and customer questionnaires.
OT and Plant Floor Security Policy Template
Protect the machines, PLCs, HMIs and plant PCs that run production: an equipment list, a wall between office and plant networks, safe vendor access, USB rules, backups of machine programs and a plan for machines you cannot patch.
Vendor Remote Access Policy Template
Control how vendors, machine builders, software suppliers and IT providers connect in: approved tools only, a named account and MFA for every technician, access switched on per session, logged sessions and quick removal.
Incident Response Playbooks Template
Step-by-step playbooks for email account takeover, vendor or IT provider compromise, insider data theft, malware, misdirected data and website attacks, built to work with your incident response plan.
Incident Report Form Template
The forms to fill in during a cyber incident: an initial report, triage sheet, timestamped log, evidence and chain of custody register, decision log, notification tracker, cost tracker and closure summary.
Tabletop Exercise Plan Template
Rehearse your incident response plan in a two-hour guided discussion: ready-made ransomware, wire fraud and account takeover scenarios with timed injects, a scoring sheet and an after-action report.
IT operations
IT Acceptable Use Policy Template
Set clear rules for how employees use company computers, email, internet, software and data, and what monitoring they should expect.
Remote Work and BYOD Policy Template
Let people work from home and use their own phones safely, with clear rules for home networks, device enrollment, company data and what happens when someone leaves.
Data Backup and Recovery Policy Template
Define what gets backed up, how often, where copies live and how fast you must recover, using the 3-2-1-1-0 rule that ransomware now demands.
Business Continuity Policy Template
Keep the business running through storms, outages, fires and cyberattacks: critical functions, recovery targets in plain words, a call tree and an annual tabletop test.
IT Asset Disposal Policy Template
Retire old computers, phones, servers and copiers safely: track every device, wipe or destroy data to NIST SP 800-88, get certificates of destruction, and recycle through certified recyclers.
Compliance and vendors
WISP (FTC Safeguards Rule) Template
A written information security program built for the FTC Safeguards Rule, for tax preparers, CPA firms, mortgage brokers, auto dealers that finance and other businesses the law treats as financial institutions.
Vendor Risk Management Policy Template
Choose and monitor the vendors that hold your data or reach your systems: a vendor list, simple risk tiers, security questions, contract clauses, remote access rules and a clean exit.
Data Retention and Destruction Policy Template
Decide what records to keep and for how long, with a sensible default schedule, legal holds, and secure destruction of paper and devices following NIST SP 800-88.
Data Protection and Privacy Policy Template
Set internal rules for the personal and confidential data you hold: collect less, limit access, share carefully with vendors, handle requests, and respond to a breach under North Carolina law.
IT Supplier Code of Conduct Template
Set clear expectations for the companies you buy IT from: security, data protection, ethics, labor and environmental basics, take-back and recycling, and your right to ask for evidence.
System Security Plan (SSP) Starter Template
A starter System Security Plan for defense contractors that handle CUI, organized by the 14 NIST SP 800-171 families, with a plan of action and milestones (POA&M) section and the CMMC rules that apply to it.
Breach Notification Procedure Template
Decide with your breach counsel whether an incident legally requires notice, then notify the right people with the right content: North Carolina rules by default, with HIPAA, FTC, DFARS and multistate steps when they apply.
How does the policy generator work?
Four steps, and most visitors finish in a few minutes: policy choices start at a suggested setting, and you answer the facts about your organization.
- 1
Read the full sample
Every template is public, section by section, before you enter anything.
- 2
Answer a short set of questions
Policy choices start at a suggested setting you can accept or change. Facts about your organization, such as the data you hold, you answer yourself.
- 3
Unlock and download
Share your contact details once to unlock the complete policy and a PDF with a document ID, version and review date.
- 4
Have it reviewed
A template is a starting point. Have qualified legal counsel review the policy before you adopt it.
Frequently asked questions
Are these policy templates really free?
Yes. Reading every sample and building your own policy costs nothing. Before the finished document and PDF unlock, we ask for your name, work email and company, and Preferred Data Corporation may follow up about related services.
Is a policy template legal advice?
No. Preferred Data Corporation is not a law firm and these are starter templates. Before you adopt or rely on a policy, and in every case where you have a legal, regulatory or contractual obligation, have it reviewed by qualified legal counsel.
What do I get at the end?
A PDF of the full policy with your organization name, policy owner, approver, effective date and next review date, a unique document ID, and a revision history table so you can track every change after adoption.
Where are my answers stored?
Your answers stay in your browser while you work, saved there so you can pick up where you left off. When you unlock the download, your contact details and answers are sent to our server, which builds a short record of your key choices, such as your industry and company size, for our team. We keep your contact details and that summary, not your full document.
How do I know a template is current?
Every template shows its version number and the date it was last reviewed, and each generated policy records the template version it came from. When a template changes, its version number changes too.
Need more than a template?
Preferred Data Corporation has helped businesses put technology policies into practice from High Point, NC since 1987. We can tailor a policy set to your systems, train your team and set up the controls behind it.