Home
cd ../playbooks
Operations & ComplianceBeginner

Policy & Procedure Documentation

Create comprehensive policy documents and procedure manuals with version control, approval workflows, and compliance mapping.

10 minutes
By communitySource
#policy#procedures#documentation#compliance#governance

The auditor asks for your data retention policy and you find a 3-year-old Google Doc that nobody follows. Policies exist in someone's head or not at all. When compliance gaps surface during audits or incidents, retroactive documentation costs 10x more than getting it right the first time.

Who it's for: compliance officers building policy libraries for regulatory audits, operations managers documenting standard operating procedures, quality assurance leads creating ISO-compliant process documentation, HR directors formalizing company policies, IT managers writing security and acceptable use policies

Example

"Create a remote work policy for our 200-person company" → Complete policy package: policy statement with scope and applicability, detailed procedures with step-by-step workflows, approval chain and version control metadata, compliance mapping to relevant regulations, FAQ for employees, and manager implementation guide

CLAUDE.md Template

New here? 3-minute setup guide → | Already set up? Copy the template below.

# Policy & Procedure Documentation

## Your Role
You are an expert compliance and governance writer. Your job is to create clear, comprehensive policy documents that are both compliant and understandable.

## Core Principles
- Write for the newest employee — plain language always
- Map to regulatory requirements explicitly
- Include concrete examples and scenarios
- Define clear ownership and review schedules
- Version-controlled with change tracking

Get new playbooks like this one

One email a week with new Claude Code workflows. Free, like everything here.

No spam. Unsubscribe anytime.

README.md

What This Does

Generates structured policy and procedure documents with clear ownership, approval workflows, compliance mappings, and version tracking. Ensures consistency across organizational documentation.


Quick Start

Step 1: Download the Template

Click Download above to get the CLAUDE.md file.

Step 2: Define the Policy Area

Know: what needs documenting, regulatory requirements, stakeholders, and existing practices.

Step 3: Start Using It

claude

Say: "Create a data retention policy that covers GDPR requirements for our SaaS platform"


Document Structure

Section Content
Purpose & Scope Why this policy exists and who it applies to
Definitions Key terms clarified
Policy Statements Clear rules and requirements
Procedures Step-by-step implementation
Responsibilities Who owns what
Compliance Mapping Which regulations this satisfies
Review Schedule When and how to update

Tips

  • Write for the newest employee: Clear enough for someone on day one
  • Include examples: Abstract policies need concrete scenarios
  • Map to regulations: Show which requirement each section satisfies
  • Version control: Track changes with date, author, and approval

Commands

"Create a policy document for [topic]"
"Map this policy to GDPR/SOC2/ISO requirements"
"Generate an employee-friendly summary of this policy"
"Create a compliance checklist from this policy"

Troubleshooting

Policy is too vague Add: "Include specific examples and scenarios for each policy statement"

Too legalistic Say: "Write in plain language — a new hire should understand this"

Missing compliance requirements Specify: "Map every section to specific GDPR articles"

$Related Playbooks

Operations & Compliance

WCAG Accessibility Advisor

Audit and fix digital accessibility against WCAG 2.0/2.1/2.2 — success criteria, A/AA/AAA conformance, POUR principles, ARIA patterns, contrast and keyboard issues, accessibility statements, and legal mapping.

10 minutes
Intermediate
Operations & Compliance

SWIFT CSP Advisor

Meet the SWIFT Customer Security Programme — CSCF v2025 controls, architecture-type scoping (A1-A4/B), mandatory vs. advisory controls, KYC-SA attestation, and independent-assessment readiness.

10 minutes
Advanced
Operations & Compliance

Detecting NTLM Relay with Event Correlation

A blue-team methodology for detecting NTLM relay attacks (MITRE ATT&CK T1557.001) via Windows event correlation — IP-to-hostname mismatch on logon events, LLMNR/NBT-NS poisoning-tool signatures, SMB/LDAP signing audits, and NTLM downgrade detection across Active Directory.

15 minutes
Advanced
Operations & Compliance

NZISM Advisor

Apply the New Zealand Information Security Manual — control guidance, gap analysis, agency security obligations, classification scoping, risk management, and system Certification & Accreditation.

10 minutes
Advanced
Operations & Compliance

PCI DSS Advisor

Scope your cardholder data environment, pick the right SAQ, work through the 12 PCI DSS v4.0.1 requirements, plan segmentation and testing, and prepare for a QSA assessment.

10 minutes
Intermediate
Operations & Compliance

Section 508 Accessibility Advisor

Meet US federal ICT accessibility under Section 508 — WCAG 2.0 AA mapping, accessibility audits, VPAT/ACR authoring, remediation planning, PDF and software accessibility, and procurement requirements.

10 minutes
Intermediate
Operations & Compliance

SOC 2 Compliance Advisor

Prepare for SOC 2 across all five Trust Services Criteria — gap analysis, policy writing, control documentation, audit-evidence prep, and vendor-risk questionnaires for Type 1 and Type 2.

10 minutes
Intermediate
Operations & Compliance

TSA Cybersecurity Compliance Advisor

Meet TSA Security Directives for pipelines, rail, and transit — Cyber Risk Management Program, CIP/COIP/CAP plans, Critical Cyber Systems, OT/IT segmentation, Cybersecurity Coordinator, and CISA reporting.

10 minutes
Advanced
Operations & Compliance

SOPs & Process Executor

Document your standard operating procedures once and let Claude execute them exactly, every time — no re-explaining, no missed steps, no improvisation.

20 minutes
Intermediate
Operations & Compliance

Operational Runbook Creator

Create operational runbooks for recurring tasks with step-by-step procedures and checklists

10 minutes
Intermediate
Operations & Compliance

Security Monitoring Setup

Automate security monitoring, threat detection, incident response, and compliance workflows

10 minutes
Intermediate
Operations & Compliance

Energy Procurement Strategy

Codified expertise for electricity and gas procurement, tariff optimization, demand-charge management, and renewable PPA evaluation — the working knowledge of a senior C&I energy procurement manager running a $15M-$80M annual spend across dozens of facilities.

10 minutes
Advanced

Browse all Operations & Compliance playbooks →