Security policies people can read on a Tuesday afternoon
We write and review the policies and procedures behind your security, so they say what you actually do and the people who follow them can understand them.
Overview
Why the policy set matters
Policies say what the organisation expects. Procedures say how it is done. Auditors, clients and regulators read both, and so do the people who have to follow them. ISO/IEC 27001 requires an information security policy and expects topic-specific policies around it, and frameworks such as NIS2, DORA and SOC 2 all look for documented rules.
The common failure is a stack of borrowed templates that nobody has read, describing processes nobody runs. We do the opposite. We interview the owners, look at how the work is done and write documents that match it, or tell you plainly where the practice needs to change before the paper does.
A policy is a promise in writing. We help you make promises you can keep.
Who it is for
Organisations preparing for ISO/IEC 27001, SOC 2, NIS2 or DORA, companies answering client questionnaires that ask for their policies, and teams whose existing documents no longer describe how they work.
The work, from scoping to evidence.
What we do
Policy set review
We read what you have, check it against the frameworks you report on and against practice, and mark what is missing, outdated or contradictory.
Core policies
An information security policy, plus topic-specific policies such as acceptable use, access control, cryptography, logging and change management.
Incident response
An incident response policy and procedure with roles, escalation and reporting, including the notification duties that apply to you.
Supplier and backup
Supplier security, backup and restore, business continuity and other operational policies, tied to the controls they rely on.
Procedures and records
Step-by-step procedures where they help, and the records that prove they were followed.
Document control
Owners, review dates, versioning and approval, so the set stays current after we leave.
How the engagement runs
Kickoff
We agree which documents are in scope, which frameworks they must satisfy and who owns them, and sign an NDA first if you need one.
Proposal
A business proposal with the document list, the method and the contract type that suits you.
Review and interviews
We read the current set and talk to the people who do the work it describes.
Drafting
Drafts written in plain language, reviewed with owners and adjusted until they match practice.
Handover and approval
Final documents, a mapping to the frameworks in scope and a short briefing for those who approve and follow them.
Closing
Project close with feedback, and optional periodic review to keep the set current.
What you receive
- Gap review of your current policy set
- Information security policy and topic-specific policies
- Procedures and record templates where needed
- Mapping of each document to the requirements it meets
- Document control register with owners and review dates
- Briefing material for staff and approvers
Questions
Can't we just use templates?
Templates are a fine starting point and we use structures that auditors recognise. The problem is content that does not match your practice. An auditor samples evidence against what the policy says, and a policy you do not follow becomes a finding.
How many policies do we need?
As many as your risks, scope and frameworks call for, and no more. Some organisations do well with a short set and a few procedures. We size it to you.
Will the documents pass the audit?
No one can promise that. The audit looks at whether you follow the documents, not only at the documents. We write them to meet the requirements and to match what you do, which is what auditors test.
Can you also train staff on the new policies?
Yes. Security awareness training is one of our services, and a short briefing is part of the handover.
Related services
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Advisory and responseSecurity awareness trainingTraining from Black Fox Security: security and social engineering awareness, incident response and DevSecOps, for staff, developers and management.
- Governance and riskInformation security auditIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.
- Compliance and certificationNIS2NIS2 support from Black Fox Security: applicability check, gap assessment against the risk-management measures, incident reporting, supply chain and training.
Send us the binder
Or tell us there is no binder. Either way, we will tell you what your policy set needs.