Governance

Development of Policies & Procedures

A complete, coherent security policy and procedure suite tailored to your organisation and mapped to the standards you answer to, written so your team will actually use them.

Book a scope call All Governance & Frameworks

Overview

Security policies set the rules; procedures turn them into repeatable action. Auditors, certification bodies, and regulators expect both, and they expect both to reflect what you actually do. A downloaded template with your name on the cover page does not pass that test.

We develop a complete, coherent suite of cybersecurity policies and procedures, tailored to how your organisation operates and mapped to the specific frameworks in scope: ISO/IEC 27001, PCI DSS, GDPR, HIPAA, SOC 2, or a combination. Every document is consistent with every other, version-controlled, and written in plain language. The goal of rigorous security policy development is documentation that serves as a reliable safeguard against audit findings, not just a paper record.

Where a standard requires a formal policy (ISO/IEC 27001 Annex A, for instance, names dozens), we make sure you have it and that it says something meaningful. Where a procedure is needed to make a policy real (an access provisioning procedure behind an access control policy, for example), we write that too. Best practices across information security require that sensitive data, confidential information, and information assets each have a clear policy owner and documented handling procedure.

Good cybersecurity policy development also accounts for the threats your organisation faces. Policies covering phishing and social engineering, ransomware response, unauthorized access, authentication and password requirements, and BYOD expectations give your team the guidance they need to respond correctly when security incidents occur. A breach is not a question of if but of whether your organisation has the documented security measures to detect, contain, and report it in line with your regulatory compliance obligations.

What’s included

Information security policy suite covering access control, asset management, cryptography, physical security, supplier relations, and more
Data protection and privacy policies, including a Records of Processing Activities register structure for GDPR
Operational procedures and standards that back each policy with repeatable steps
Incident response policy and procedure, aligned to your notification obligations for security incidents and data breach reporting
Authentication policy covering password requirements, multi-factor authentication, and system access controls
Acceptable use policy addressing BYOD, phishing awareness, and unauthorized system access
Business continuity and disaster recovery policy
HR security policies covering onboarding and offboarding
Cross-mapping to ISO/IEC 27001, PCI DSS, GDPR, HIPAA, and SOC 2 requirements
Version control setup and documented policy review cycle

How we work

01
Assess
We review what documentation you already have, identify the gaps against your in-scope frameworks, and learn how your organisation actually operates. Security policies that do not match reality create audit findings, so we start with reality. We also conduct a risk assessment of the areas where missing or outdated policies create the greatest organizational exposure.
02
Draft
We author or rewrite each policy and procedure from scratch, tailored to your environment and mapped to the control requirements of the standards in scope. We write for the person who will follow the procedure, not just the auditor who will read the policy. Cybersecurity policies covering security threats like phishing emails, ransomware, and unauthorized access are written in language that gives staff clear, actionable guidance.
03
Review
We circulate drafts to your nominated stakeholders and refine the documents until they are accurate, workable, and owned by the people responsible for them. A policy nobody recognises as theirs will not be followed. This review pass also checks that security measures described in each policy are consistent with your actual information technology environment and industry standards.
04
Embed
We set up version control and a structured annual policy review cycle so the documentation stays current as your environment and obligations change. Certification bodies and regulators check document history. Regular policy updates ensure your cybersecurity documentation continues to meet compliance requirements and reflects your evolving security posture.

What you get

Tailored information security and privacy policy suite
Operational procedures and standards linked to each policy
Framework mapping matrix showing which documents satisfy which control requirements
Version control register and documented policy review cycle

Frequently asked questions

Do you use templates or write from scratch?

We start from proven document structures built on years of audit experience, then tailor every document to your operations, your environment, and the specific standards in scope. Auditors and certification bodies read security policy suites constantly and spot boilerplate quickly. A policy that says your organisation does something you do not actually do is a liability, not an asset. Generic policy templates may satisfy a checkbox but they rarely survive scrutiny from an experienced auditor.

Can one policy suite cover ISO 27001 and PCI DSS at the same time?

Yes. We map each document to the relevant requirements across all frameworks in scope so one coherent suite supports multiple obligations. We include a mapping matrix that shows exactly which documents satisfy which control requirements, which simplifies evidence collection during audits and helps you demonstrate regulatory compliance to multiple regulators or enterprise customers simultaneously.

What is the difference between a policy and a procedure?

A policy states the rule: what must happen and why it matters to the organisation. A procedure states how it happens: the repeatable steps a named role follows to carry out the policy. Both are required by ISO/IEC 27001 and most other frameworks. One without the other is incomplete. A cybersecurity policy that prohibits unauthorized access is effective only when backed by an access provisioning procedure that defines exactly how access is granted, reviewed, and revoked.

Who in our organisation needs to be involved?

We typically engage your CISO or Head of IT for technical accuracy, your legal or compliance team for privacy and regulatory language, and the process owners for each procedure. We manage the policy development review cycle and turn inputs into finished documents. The time commitment from your team is relatively light.

What happens when our processes change?

We set up a version control register and a documented annual review schedule. When you engage us for a review cycle, we update the documents to reflect changes and re-check mapping to your frameworks. Current, accurate documentation is a recurring audit requirement, not a one-time task. Outdated security policies create the same risk as no policies at all: they describe a security posture that no longer exists.

Do your policies cover specific cybersecurity threats like phishing and ransomware?

Yes. Effective security policy development addresses the real threats your organisation faces. We include policies covering phishing emails and social engineering, ransomware response, password and authentication requirements, BYOD security needs, and the handling of sensitive data and confidential information. These are practical security measures, not abstract statements, and they are written at a level that gives your staff clear guidance when an incident occurs.