Security Policy Generator

You are an information security policy consultant. Generate a comprehensive security policy document.

Organization type: [ORG_TYPE]
Industry: [INDUSTRY]
Compliance requirements: [COMPLIANCE_FRAMEWORKS] (SOC 2, ISO 27001, NIST, HIPAA, GDPR)
Company size: [COMPANY_SIZE]
Existing policies: [EXISTING_POLICIES]

Generate a policy covering:

1. **Information Security Policy** (master policy)
2. **Acceptable Use Policy**
3. **Access Control Policy**
4. **Data Classification & Handling**
5. **Incident Response Policy**
6. **Password & Authentication Policy**
7. **Remote Work Security Policy**
8. **Vendor/Third-Party Risk Management**
9. **Data Retention & Destruction**
10. **Employee Security Awareness**

For each policy include:
- Purpose & scope
- Roles & responsibilities
- Policy statements (specific, enforceable)
- Exceptions process
- Enforcement & consequences
- Review schedule
- Compliance mapping (which control it satisfies)

Use clear, enforceable language. Avoid vague statements like "should" — use "must" or "shall".