---
id: 03-policy-templates
epic: compliance-docs-scaffolds
title: Write seven policy templates in docs/compliance/templates/
type: user-story
status: todo
feature: ~
depends-on: []
blocks: [04-pre-launch-compliance-checklist, 05-compliance-overview]
created: 2026-05-20T12:00:00Z
updated: 2026-05-20T11:58:25.281Z
---

## Goal

Create `docs/compliance/templates/` and populate it with seven `*.template.md` files: two anchored templates (`incident-runbook`, `dsr-procedure`) cross-referencing real shipped features, and five skeleton templates (`backup-policy`, `password-policy`, `device-policy`, `onboarding`, `offboarding`) with "not code-enforced" banners. All templates use the `[FILL IN: <description>]` marker convention throughout.

## Why

A downstream consumer preparing for a DPA audit currently writes organizational policy documents from a blank page. These templates reduce that to copy-and-fill work. The anchored templates are substantive because the template ships the relevant code (DSR endpoints, audit channel, Sentry alerting, security headers, rate-limit) — they reference real ADR numbers and `pnpm` commands so the procedure matches the shipped system. The skeleton templates provide the document structure; the consumer supplies the organization-specific content.

## Done when

- `docs/compliance/templates/` directory exists with exactly 7 files: `incident-runbook.template.md`, `dsr-procedure.template.md`, `backup-policy.template.md`, `password-policy.template.md`, `device-policy.template.md`, `onboarding.template.md`, `offboarding.template.md`.
- Each template has YAML frontmatter with `status: template` and `playbook-section: <n>`.
- Anchored templates (`incident-runbook`, `dsr-procedure`) each reference at least one ADR number and one `pnpm` command or shipped interface/endpoint; each still contains `[FILL IN:]` markers for org-specific values (contacts, SLA targets, etc.).
- Skeleton templates all open with the "not code-enforced" banner; `password-policy.template.md`'s banner cites ADR-025's explicit deferral of MFA + password policy + lockout by ADR number.
- `grep -rn '\[FILL IN:' docs/compliance/templates/` returns hits in every template.
- Every relative Markdown link in the new files resolves to an existing file.
- `pnpm lint && pnpm typecheck && pnpm test && pnpm conformance && pnpm fallow:audit` all pass.

## In scope

- `docs/compliance/templates/incident-runbook.template.md` — breach detection → triage → containment → notification (GDPR Art. 33 72h / DPA 24h) → post-mortem; cross-references ADR-018 (audit channel), ADR-014 (Sentry alerting), Epic C (security-headers + rate-limit surfaces).
- `docs/compliance/templates/dsr-procedure.template.md` — DSR receipt → validation → fulfilment → recording; cross-references Epic B DSR endpoints (`/api/gdpr/*`), `core-dsr` interfaces, audit `CONSENT_*`/`RESTRICT` actions, `compliance/data-map.yml` (Epic A).
- `docs/compliance/templates/backup-policy.template.md` — skeleton with banner.
- `docs/compliance/templates/password-policy.template.md` — skeleton with banner; banner cites ADR-025 MFA/password/lockout deferral.
- `docs/compliance/templates/device-policy.template.md` — skeleton with banner.
- `docs/compliance/templates/onboarding.template.md` — skeleton with banner.
- `docs/compliance/templates/offboarding.template.md` — skeleton with banner.

## Out of scope

- Filling in org-specific values — the `[FILL IN:]` markers are intentionally left for the consumer.
- Any changes to existing compliance guides (`dsr.md`, `consent.md`, etc.).
- A CI gate enforcing no `[FILL IN:]` in `compliance/` (deferred).

## Tasks

- [ ] Create `docs/compliance/templates/` and write `incident-runbook.template.md` + `dsr-procedure.template.md`: both anchored with YAML frontmatter (`status: template`, `playbook-section`), procedure skeleton cross-referencing real ADRs/commands/interfaces/endpoints, and `[FILL IN:]` markers for org-specific values; commit as `docs(compliance): add anchored policy templates (incident-runbook, dsr-procedure)`.
- [ ] Write `backup-policy.template.md`, `password-policy.template.md`, `device-policy.template.md`, `onboarding.template.md`, and `offboarding.template.md` in `docs/compliance/templates/`: each with YAML frontmatter, the "not code-enforced" banner (password-policy's banner cites ADR-025 MFA/lockout deferral by number), and `[FILL IN:]` markers throughout; commit as `docs(compliance): add skeleton policy templates (backup, password, device, onboarding, offboarding)`.