Security policies people can actually follow.
Policies are only useful if they describe how your organization really works, have someone responsible for them, and are reviewed when things change. We help you write and maintain policies suited to your business and technology.
Template policies fail at the first audit question.
Downloaded templates often describe controls you do not have, use roles that do not exist in your organization, and are never read by the people they apply to. Auditors and customers notice the gap between what the policy says and what people do.
Good governance is less about volume and more about clarity: a small number of well-structured policies, supported by procedures where detail is needed, with named owners and a review cycle.
What makes a policy useful
- 1A clear owner
Someone accountable for keeping it accurate.
- 2Formal approval
Endorsed by the right level of management.
- 3Communication
People know it exists and what it asks of them.
- 4Periodic review
Updated on schedule and when things change.
Teams that need governance to match reality.
- Organizations preparing for SOC 2 or ISO/IEC 27001
- Startups answering customer security questionnaires
- Businesses whose policies are outdated
- Healthcare technology teams addressing HIPAA
- Organizations after a merger or reorganization
Writing, and keeping policies current.
- Review existing policies against your operations and frameworks
- Draft new policies and supporting procedures
- Align terminology and roles with your organization
- Define owners, approvers and review cycles
- Build a policy register and exception process
- Plan communication and acknowledgement
- Support periodic policy reviews
- Map policies to SOC 2, ISO/IEC 27001 or HIPAA requirements
A policy set sized to your organization.
We agree which topics you need based on your scope, frameworks and risks.
- Information securityTop-level commitments, roles and scope.
- Access controlGranting, reviewing and removing access.
- Asset managementInventory, ownership and lifecycle.
- Data classification & handlingLabels and rules for each class of data.
- Acceptable useExpected behaviour with systems and devices.
- Vulnerability managementIdentifying, rating and fixing weaknesses.
- Secure developmentSecurity in design, code, review and release.
- Incident responseDetecting, escalating and learning from incidents.
- Backup & recoveryWhat is backed up, how often, and how it is tested.
- Supplier securityAssessing and monitoring third parties.
- Onboarding & offboardingSecurity steps when people join, move or leave.
- Security awarenessTraining expectations by role.
A governance set you own.
Policy set
Agreed policies in your format, in editable form.
Policy register
Owners, approvals, versions and review dates.
Framework mapping
Which policy addresses which requirement.
Review & communication plan
When policies are reviewed and how staff are informed.
Security Policies & Governance FAQ
How many policies do we need?
It depends on your size, scope and frameworks. Many smaller organizations work well with a compact set of policies supported by procedures, rather than dozens of overlapping documents.
Can you work with our existing documents?
Yes. We usually start by reviewing what you have and improving it, rather than replacing everything.
Will the policies satisfy an auditor?
Policies are one part of what an auditor examines; they also look at whether controls operate as described. We write policies to reflect your actual practices, but the auditor makes their own assessment.
Ready to tidy up your policies?
Share what you have today and what is driving the work. We will suggest a practical scope.