Tools · Policy Packs

Policies written to be implemented and enforced.

NIST SP 800-171 Rev. 2-aligned policy and procedure sets, each mapped to the control objectives an assessor will test. A policy that doesn't match your configuration is a finding waiting to happen, so we write these to be enforced.

How the packs are built

OBJECTIVE-MAPPED

Traceable to what assessors test

Each policy statement maps to specific NIST SP 800-171 Rev. 2 assessment objectives, so the document defends itself under review.

CONFIGURATION-ALIGNED

Written against Microsoft reality

The language reflects how controls are enforced in GCC High, Intune, Purview, Defender, and Entra ID Conditional Access.

FAMILY COVERAGE

All 14 control families

Access Control through System & Information Integrity, plus supporting procedures for incident response, media handling, and personnel security.

LIVING DOCUMENTS

Built for revision

Structured for version control and annual review cycles, with change-log scaffolding that becomes its own evidence artifact.

Pair with implementation

Assessors test enforced configurations, so policies alone won't pass. The packs work best paired with the fixed-scope gap assessment, so every policy statement is backed by a control that's actually on.

Get the Catalog

Request the policy pack catalog.

We'll send the current catalog (coverage by control family, formats, and pricing) and tell you which packs matter most for where your program stands. You can also email rj@indirectit.com directly.