Policies and procedures

Introduction

Policies describe intent. They say what the company believes, what standard it is trying to meet and what behaviour is expected.

Knowledge scope

This is startup-specific guidance in the public playbook. It is framed around the Company Ready -> POC Started decision point and the practical trade-offs a small company faces while moving from idea to Production.

Why it matters

Procedures describe how the policy is carried out and how evidence is produced. That distinction matters for startups because lightweight policies can still create strong operating habits and better customer onboarding.

How it fits the playbook

This reference supports the Company Ready -> POC Started stage of the startup CTO playbook. It gives the public context for the decision without exposing the deeper assessment method behind the agentic operating model.

Design considerations

• Use ISO 27001 as a baseline without pretending early certification is the goal.
• Start with core policies for access, change, data classification, data protection, logging, secrets, incidents, backups, suppliers and devices.
• Include document management so policies have owners, versions, reviews and approval evidence.
• Let AI draft, but require people to read, challenge, approve and own content.
• Back every policy with a procedure that can produce evidence.

What good looks like

The company has short, useful policies, practical procedures and evidence that the documents are controlled, reviewed and owned.