AI-Native Consulting

Infrastructure Solutions

Move, modernize and run

Microsoft Solutions

AWS

Infrastructure Services

Data Center Migration

Business Resilience

Keep the business running

Business Continuity

IT Disaster Recovery

Crisis Management

Cyber Security

Managed Services

Co-managed, not outsourced

Home/Cyber Security/Security Policy Development

Security Policy Development · Security Advisory

Our policies are old, unapproved or not followed, and someone wants evidence.

For CISOs, IT leaders who carry the security remit, and compliance teams

Talk to us about thisHow it works
You receivePolicy gap list · Agreed policy set and owners · Approved policy set
What we need from youYour existing policies, a named approver for each policy, and the framework or customer requirement being met.
Timing and scopeOverall timing depends on the size of the policy set and your approvers, and is confirmed in the proposal.

Most policy gaps are not about writing. They are about approval, review cadence and evidence that staff have read and accepted the policies. We review your existing policies against the framework you are measured on, or good practice if none is formalized, draft new or updated policies in plain language, and run them through an approval workflow with your leadership. You receive an approved policy set, an employee attestation process and the evidence package an auditor will ask for.

How we work

What we do

Open a step to see what happens and what you receive.

Review
  • Review existing policies against your framework, or good practice if none is formalized
  • Agree the policy set and the owner of each policy

You receive: a policy gap list; an agreed policy set and owners.

Draft and approve
  • Draft new or updated policies in plain language that fits how you work
  • Run the review and approval workflow with your leadership

You receive: an approved policy set; an approval and version record.

Evidence
  • Set a review cadence and employee attestation process
  • Assemble the evidence package an auditor will ask for
  • Re-review on your next cycle, as scoped

You receive: an attestation process and records; policy-to-control traceability; a review calendar.

Want to know what this would look like for you?About 30 minutes with a practitioner from the practice that does the work. You’ll leave with a clear view of your next step.

Book a 30-minute conversation

Outcomes

What you can expect

Implementation

  • Policies that are current, approved and in force
  • Evidence ready for auditors, customers and underwriters
  • A review cadence that keeps the set current
  • Questionnaires answered: current, approved policies ready to share when customers ask, so security reviews stop holding up contracts
  • Attestations you can stand behind: an evidence package behind the controls your insurance application or audit asks you to confirm

Is this right for you?

Tick what sounds familiar

Select the needs that apply. We’ll collect them here so you can review the fit.

DeliverablesDeliverables (7)
  • Policy gap list
  • Agreed policy set and owners
  • Approved policy set
  • Approval and version record
  • Employee attestation process and records
  • Policy-to-control traceability
  • Review calendar

Good to know

Questions leaders ask

We already handle policy internally. Why bring you in?

That is a good start. The gap is rarely authorship; it is approval, review cadence and evidence of employee attestation. We can work with what you have and focus on those.

How long does it take?

Overall timing depends on the size of the policy set and how quickly your approvers review, and is confirmed in the proposal.

What do you need from us?

Your existing policies, a named approver for each policy, and the framework or customer requirement being met.

Will this make us compliant or certified?

We give you the evidence and the remediation plan your auditor is going to ask for. Audit opinions and certifications are issued by independent auditors and certification bodies.

Who does the work?

Senior practitioners, who are reachable during the engagement. We confirm the team in the proposal.

Related offerings

Often paired with

Security Audit and Readiness Assessment

“Where do we stand against our framework, and what do we fix first?”We assess your controls against the framework your auditor, customer or regulator uses, such as SOC 2, ISO 27001, HIPAA, PCI DSS 4.0, CMMC or NIST CSF, or against good practice if none is formalized yet. Learn more

Penetration Testing

“A customer, auditor or underwriter needs a current, credible test report.”We test the applications, networks or cloud environments you agree in scope, manually as well as with tools, inside written rules of engagement and agreed testing windows around your release cadence. Learn more

Talk with our team

Talk to us about Security Policy Development

Tell us the decision, deadline or problem in front of you.

  1. A reply from the practice that does the workThe practitioners who would deliver it.
  2. A short conversationWhat needs to happen, and by when.
  3. A written proposalWhat you would receive, how long it takes and the fee, before you commit.

No cost, no obligation.

Loading the form…

Prefer to ask now?