Twenty editable governance, risk & compliance templates — mapped to SOC 2, ISO 27001, NIST CSF, HIPAA and PCI DSS
Stop writing policies from a blank page. The DimensionStone Security GRC Templates Bundle is a downloadable pack of 13 policy and plan templates plus 6 working registers (risk register, control matrix, vendor register, exception register, audit plan, training log) and a 30-day implementation guide with a full framework crosswalk. Editable .docx, instant download.
$300
Download the bundle — $300 Try the free starter kit firstWhat's in the bundle
Governance policies
- Information Security Policy
- Risk Management Policy
- Acceptable Use Policy
- Data Classification & Handling Policy
- Data Retention & Disposal Schedule
- Security Awareness & Training Policy
Operational policies
- Access Control Policy
- Change Management Policy
- Vulnerability & Patch Management Policy
- Logging & Monitoring Policy
- Vendor & Third-Party Risk Management Policy
Response & resilience plans
- Incident Response Plan (with severity model, notification triggers and contact roster)
- Business Continuity & Disaster Recovery Plan (with BIA table)
Registers & worksheets
- Risk Register (pre-scored examples)
- Statement of Applicability / Control Matrix — 15 cross-framework controls pre-mapped
- Vendor Register + 25-question security questionnaire
- Exception Register
- Internal Audit & Control Testing Plan
- Policy Acknowledgement & Training Log
Every template includes
- Document-control block (owner, approver, version, review cadence)
- Purpose, scope, testable policy statements, roles, exceptions and enforcement sections
- A framework mapping table: SOC 2 Trust Services Criteria, ISO 27001:2022 Annex A, NIST CSF 2.0, HIPAA Security Rule, PCI DSS 4.0 and CIS Controls v8 references
- Bracketed placeholders and tailoring guidance so you delete what you do not do — auditors test what you write
How it works
Instant download link on the order page and in your confirmation email (.zip, editable Word files).
Follow the START-HERE guide: governance week 1, control baseline week 2, operational policies week 3, resilience & people week 4.
Run the registers quarterly and the audit plan annually. Need help? Use the Compliance Readiness Review for an expert pass before your audit.
Templates support preparation for third-party audits and certifications. They are not a SOC 2 report, ISO certificate or any other credential — those are issued only by licensed CPA firms or accredited certification bodies.
How this differs from our other offers
- GRC Templates Bundle ($300) — do-it-yourself documents and registers. One-time purchase.
- Free Compliance Assessment Starter Kit — a single starter checklist to see where you stand.
- Compliance Readiness Review ($1,000) — we review your documents and evidence and tell you what an auditor will flag.
- GRC as a Managed Service — we run the GRC function for you month to month.
Questions
What format are the files?
Microsoft Word (.docx), delivered as a single .zip. They open in Word, Google Docs, LibreOffice and Pages.
Licence?
Single-organisation internal use, unlimited users within that organisation. Consultants need one licence per client organisation.
Refunds?
Digital download — see our refund policy. If a file is corrupted or missing, reply to your order email and we will fix it.
Updates?
Framework references are current to SOC 2 TSC 2017 (2022 points of focus), ISO 27001:2022, NIST CSF 2.0 and PCI DSS 4.0. Purchasers receive revised files by email when we update the pack.