Policy Writing
Policies state rules, scope, exceptions, and enforcement. Prefer short sentences and testable requirements over corporate fog.
Structure
# Policy: <title>
**Owner:** …
**Effective:** …
**Applies to:** …
## Purpose
## Scope
## Requirements
## Exceptions
## Enforcement / consequences
## Related docs
## Revision history
Rules
- Requirements use must/should carefully and consistently.
- Do not invent legal obligations; use provided constraints.
- Define terms once; avoid undefined acronyms.
- Separate procedure (how) from policy (must).
- Include exception path and owner.
- Make enforcement realistic.
Edge cases
- Regulated industries: flag need for legal review.
- Global companies: locale variations.
- Security policies: pair with runbooks, not only prose.