diff --git a/security-groups/README.md b/security-groups/README.md
new file mode 100644
index 0000000..c6e9823
--- /dev/null
+++ b/security-groups/README.md
@@ -0,0 +1,64 @@
+# About aws-vpc-setup :: security-groups
+
+This sets up the default base security groups needed in each VPC from the `aws-common-security-groups` module
+and associated submodules.
+* it-linux-base
+* it-windows-base
+* ois-scanner
+
+# Usage
+
+```hcl
+module "vpc-base-security-groups"
+  source          = "git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//security-groups"
+  vpc_id          = "vpc-1234568"
+  vpc_full_name   = "vpc2-dice-dev"
+  vpc_environment = "dev"
+  tags            = {}
+}
+```
+
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_sg-linux-base"></a> [sg-linux-base](#module\_sg-linux-base) | git@github.e.it.census.gov:terraform-modules/aws-common-security-groups.git//it-linux-base |  |
+| <a name="module_sg-ois-scanner"></a> [sg-ois-scanner](#module\_sg-ois-scanner) | git@github.e.it.census.gov:terraform-modules/aws-common-security-groups.git//ois-scanner |  |
+| <a name="module_sg-windows-base"></a> [sg-windows-base](#module\_sg-windows-base) | git@github.e.it.census.gov:terraform-modules/aws-common-security-groups.git//it-windows-base |  |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_account_alias"></a> [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no |
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no |
+| <a name="input_override_prefixes"></a> [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
+| <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS).  Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no |
+| <a name="input_vpc_environment"></a> [vpc\_environment](#input\_vpc\_environment) | VPC environment purpose (infrastructure, common, shared, dev, stage, ite, prod) | `string` | `null` | no |
+| <a name="input_vpc_full_name"></a> [vpc\_full\_name](#input\_vpc\_full\_name) | VPC full name component (vpc{index}-{vpc\_name}) | `string` | `null` | no |
+| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC ID | `string` | n/a | yes |
+| <a name="input_vpc_index"></a> [vpc\_index](#input\_vpc\_index) | VPC index number (integer starting at 1) | `number` | `null` | no |
+| <a name="input_vpc_name"></a> [vpc\_name](#input\_vpc\_name) | VPC name component used through the VPC descrbing its purpose (ex: dice-dev) | `string` | `null` | no |
+| <a name="input_vpc_short_name"></a> [vpc\_short\_name](#input\_vpc\_short\_name) | VPC short name component (vpc{index}) | `string` | `null` | no |
+
+## Outputs
+
+No outputs.