Services

Security Policy Development and Review

I can usually tell within a few minutes whether a security policy was actually written for the organization holding it or copied from a template and lightly edited. The copied ones have language about systems the company doesn't use, roles that don't exist, and requirements nobody has ever enforced. They exist to satisfy an auditor's checkbox, and everyone involved quietly knows that's all they're for.

A policy that actually works is short enough that people read it, specific enough that it tells someone what to actually do in a real situation, acceptable use, data classification, incident reporting, remote access, and aligned with what your organization can realistically enforce. A password policy that demands something your systems can't technically require, or a data handling rule nobody checks, teaches people that policy is theater, and that attitude spreads to the policies that actually matter.

How I write and review these

I start by understanding how your organization actually operates, not by pulling a framework's template and filling in the company name. What do people actually need to do with data day to day, what systems are in scope, what's your risk tolerance for things like personal device use or remote access. From there I write policy that reflects reality, with clear ownership of who enforces it and what happens when it's violated.

If you already have policies, I review them against what's actually being practiced, which usually turns up gaps in both directions: things the policy requires that nobody's doing, and things people are doing that the policy doesn't address at all. I'd rather shrink a sixty-page policy document down to something people will actually read and follow than hand you something comprehensive that sits in a shared drive untouched.

Who needs this

If your current policies were inherited, templated, or haven't been touched since they were first written, if you're building a security program and don't know where to start on documentation, or if an audit found a gap between policy and practice, this is worth fixing properly.

Reach out and let's talk about what your policies actually need to cover.