1. Intake and classification
Document the policy need, business driver, affected products, legal or compliance trigger, risk category, policy owner, and target effective date.
CIC governance reference
A comprehensive operating reference for creating, managing, administering, reviewing, approving, publishing, monitoring, and improving CIC policies and supporting evidence.
Policy lifecycle
CIC should run every policy through the same lifecycle so teams can prove who owns it, why it exists, how it is enforced, and how it is monitored.
2. Draft and control mapping
Write the policy and map each requirement to procedures, systems, control owners, evidence, metrics, exception handling, and enforcement method.
3. Stakeholder review
Collect review from accountable teams such as Security, Engineering, Product, Operations, Legal, Privacy, Finance, People, and executive sponsors.
4. Approval and publication
Record approvers, version, approval date, effective date, next review date, publication channel, employee acknowledgement requirement, and training impact.
5. Operational administration
Run recurring access reviews, risk assessments, evidence collection, exception reviews, training attestations, audit checks, and remediation tracking.
6. Monitoring and refresh
Track control metrics, incidents, audit findings, exceptions, regulatory changes, business changes, and annual review outcomes before refreshing the policy.
Policy library
The library should hold current policies, retired policies, procedures, templates, evidence requirements, and review history. Each policy should have an accountable executive owner, operational owner, control owner list, and review cadence.
Information Security Policy
Security Risk Management Policy
Access Control Policy
Logging and Monitoring Policy
Risk Assessment Policy
Incident Response Policy
Vendor Risk Management Policy
Data Classification and Handling Policy
Business Continuity and Disaster Recovery Policy
Secure Software Development Policy
Change Management Policy
Privacy and Data Retention Policy
Administration model
Policy owner
Owns policy intent, approves changes, resolves conflicts, and confirms annual relevance.
Control owner
Operates procedures, collects evidence, manages exceptions, and remediates gaps.
Governance admin
Maintains registers, review calendar, approval records, audit evidence, and published references.
Required records
These records make the program auditable and help CIC administer policies without relying on tribal knowledge.
Policy register
Procedure register
Control mapping matrix
Risk register
Exception register
Evidence calendar
Training and attestation log
Policy approval record
Audit and assessment tracker
Remediation tracker
Governance document pack
The repository contains the working policy and control documents under docs/governance. Each document is structured for ownership, operating controls, evidence, cadence, and audit readiness.
Privacy Policy
privacy-policy.mdPublic-facing privacy notice for data collection, use, sharing, retention, user choices, and security.
Terms of Service
terms-of-service.mdPublic-facing baseline terms for account use, platform roles, user content, financial workflows, and prohibited conduct.
Cookie Policy
cookie-policy.mdPublic-facing cookie and similar technology notice for authentication, preferences, analytics, and security.
Data Processing Addendum Summary
data-processing-addendum-summary.mdOperational summary of DPA topics for processing roles, subprocessors, security measures, rights requests, and incident notice.
Data Subject Rights Policy
data-subject-rights-policy.mdRequest intake, identity verification, review, response, and evidence for user data rights requests.
Public Profile and User Content Policy
public-profile-and-user-content-policy.mdVisibility, user responsibilities, prohibited content, credential evidence, moderation, and reporting.
Policy and Control Governance Program
policy-control-governance-program.mdPolicy lifecycle, roles, registers, exceptions, metrics, and evidence administration.
Information Security Policy
information-security-policy.mdSecurity baseline for assets, data, access, engineering, vendors, incidents, and monitoring.
Security Risk Management Policy
security-risk-management-policy.mdSecurity risk categories, register fields, ratings, treatment, acceptance, and reporting.
Access Control Policy
access-control-policy.mdProvisioning, privileged access, production access, support access, service accounts, and reviews.
Logging and Monitoring Policy
logging-and-monitoring-policy.mdLogging, monitoring, alerting, retention, review, and response controls for production and security events.
Risk Assessment Policy and Program
risk-assessment-policy-and-program.mdAnnual and event-driven risk assessments across business, product, security, financial, and vendor domains.
Incident Response Policy
incident-response-policy.mdIncident severity, triage, containment, investigation, communication, remediation, and post-incident review.
Vendor Risk Management Policy
vendor-risk-management-policy.mdVendor tiering, onboarding diligence, contract expectations, monitoring, access, and offboarding.
Third Party Risk Management Policy
third-party-risk-management-policy.mdThird-party classification, onboarding diligence, monitoring, evidence, exceptions, and offboarding.
Secure SDLC and Change Management Policy
secure-software-development-and-change-management-policy.mdRepository, PR, testing, deployment, secrets, emergency changes, and security-sensitive change controls.
Change Management Policy
change-management-policy.mdChange request, approval, testing, deployment, rollback, emergency change, evidence, and post-implementation controls.
Data Classification, Privacy, and Retention Policy
data-classification-privacy-and-retention-policy.mdData classes, handling rules, support data, logs, retention, deletion, and evidence.
Business Continuity and Disaster Recovery Policy
business-continuity-and-disaster-recovery-policy.mdCritical processes, recovery targets, backups, continuity planning, communications, and testing.
Customer Support and Identity Verification Policy
customer-support-and-identity-verification-policy.mdAuthenticated support, call-back codes, agent codes, file requests, screen sharing, and queue governance.
Financial Operations and Reconciliation Policy
financial-operations-and-reconciliation-policy.mdWallets, grants, pitches, ledgers, journal postings, duplicate prevention, reconciliation, and financial access.
Financial API Production Access Readiness Policy
financial-api-production-access-readiness-policy.mdProduction readiness for financial, identity, banking, payment, verification, and related API providers.
Acceptable Use and Personnel Security Policy
acceptable-use-and-personnel-security-policy.mdPersonnel expectations, acceptable use, prohibited activity, training, and access safety.
Security Assurance, Audit, and Assessment Program
security-assurance-audit-and-assessment-program.mdInternal assessments, independent reviews, evidence packages, findings, and remediation.
Asset and Software Inventory Process
asset-and-software-inventory-process.mdCorporate asset, production asset, software, repository, vendor software, and dependency inventory practices.
Configuration Management Process
configuration-management-process.mdConfiguration baselines, environment variables, secrets, cloud configuration, endpoint configuration, and review practices.
Monitoring, Alerting, and Triage Process
monitoring-alerting-and-triage-process.mdReal-time detection, alert severity, triage, escalation, resolution, and evidence for production and security events.
Security Assessment and Penetration Testing Process
security-assessment-and-penetration-testing-process.mdInternal assessments, independent audits, independent penetration tests, remediation, retesting, and assurance evidence.
Personnel Screening and Background Check Process
personnel-screening-and-background-check-process.mdRole-based screening and background check practices for employees, contractors, agents, and privileged users.
Vulnerability Management Program
vulnerability-management-program.mdVulnerability identification, prioritization, remediation, validation, evidence, and reporting.
Security Incident Detection, Triage, Resolution, and Notification Process
security-incident-detection-triage-resolution-and-notification-process.mdIncident detection, triage, containment, resolution, notification decisions, communications, and evidence.
Security Evidence Screenshot Pack
security-evidence-screenshot-pack.mdRedacted screenshot evidence inventory for consumer MFA before Plaid Link, critical-system MFA, and endpoint detection and response tooling.
Control Register
control-register.mdBaseline controls, owners, frequency, evidence, status, and governance expectations.
Evidence Calendar
evidence-calendar.mdMonthly, quarterly, annual, and per-event evidence collection schedule.
Governance Registers and Templates
governance-registers-and-templates.mdOperational registers and templates for policy approval, risk, exceptions, access review, incidents, vendors, evidence, and remediation.