Information security policies
Unreadable policies protect no one. We draft or revise a clear framework, sized to your organization, that teams can actually apply.
What we see too often
The most expensive reflex is to download 40 policies and paste the logo. Nobody reads them, nobody knows what to do on Monday morning, and the audit sees it immediately.
- policy and procedure mixed in the same file
- text that describes a bank, not your SMB
- no dated approval, no review
- teams were never told what concerns them
- an “ISO pack” bought, never adapted to real tools
What this module is
A policy states leadership intent: what is expected, for whom, with which authority. A procedure states how you do it. ISO 27001 needs both, at the right level, not an encyclopedia.
We draft a document frame your team can open: an overarching policy, the topic policies you actually need, and the link to operational procedures. Fewer pages, more use.
Where this sits in ISO 27001
The module anchors clause 5.2 (policy) and feeds documented information in clause 7.5. It does not replace governance (scope, SoA) or awareness.
What this module includes
- Inventory of existing policies
- Umbrella policy and essential topic policies
- Alignment with your risks, not a generic template
- Review, approval and distribution process
How we work
Inventory of what exists
What already exists, what is copied, what is never read. We keep what is true.
Document architecture
Overarching policy, topic policies, procedures. We separate intent from how-to.
Adapted drafting
Text fitted to your tools, roles and size. Not a novel, not an empty template.
Approval and circulation
Who signs, where it lives, how concerned people are told. An undistributed policy does not exist.
What you receive
- Information security umbrella policy
- 4 to 8 applicable topic policies (access, suppliers, incidents, and related topics)
- Review and approval register
- Distribution plan for the people concerned
Who it is for
SMBs with documents that are too long, too generic, or with no leadership-approved policy.
Who it is not for
This module is not the SoA, nor a training programme. It also does not write 93 procedures, one per Annex A control.
Typical duration
3 to 6 weeks depending on rewrite volume.
What you need to provide
You give access to current documents, tools (file sharing, HR, IT) and a decision-maker who can sign. A business owner per topic speeds the work.
What this module does not cover
This module delivers the documentary framework. Governance (scope, SoA, classification) and awareness are separate.
Frequently asked questions
- Do we need a policy for every Annex A control?
- No. An umbrella policy and a few topic policies are enough. The rest is handled with procedures and evidence.
- Can you start from our current documents?
- Yes. We rewrite what is usable and remove jargon that helps neither the team nor the auditor.
- Who must sign the policies?
- Leadership, or a delegated person. Without a signature and review date, the document will not hold in audit.
- Can we buy only this module?
- Yes. Each module is sold separately. You do not have to buy the full programme. The pre-assessment remains the most efficient entry point if you do not yet know where to start.
- Do we have to start with the pre-assessment?
- No, it is not mandatory. The pre-assessment speeds up scoping if you do not yet have a full picture. If you already know what is missing, we can start this module directly.