Policy Review & Development

Clear, practical security policies, written or reviewed for your organization and mapped to the frameworks and laws you need to meet.

Policy review & development

Policies your team can actually follow

Security policies set the rules for how your organization protects its people, systems and data. Auditors, insurers and customers ask for them, and your staff need them to know what is expected.

We review the policies you already have, write the ones you are missing, and tailor every document to how your organization really works, in plain language your team can follow.

Just finished a gap assessment?Your roadmap will likely call for new or updated policies. We can write them to close the specific gaps your assessment found.About gap assessments

Is this for you?

Common reasons to start here

  • A customer, insurer or auditor has asked for your security policies
  • You are preparing for ISO/IEC 27001, CPCSC or CMMC
  • Your policies are outdated or were copied from a template
  • A gap assessment found missing or weak policies
  • You have new privacy obligations, such as Quebec Law 25
  • Staff are using AI tools without clear rules

Review or develop?

Start from what you have, or start fresh

Whether you have a binder of policies or none at all, we meet you where you are.

Policy review

Is what we have good enough?

  • Compare your existing policies against the frameworks and laws that apply to you
  • Check that they match how your organization actually works
  • Mark up gaps, conflicts and outdated sections, with recommended changes

Policy development

What do we need?

  • Write new policies tailored to your size, industry and risks
  • Use plain language your staff can understand and follow
  • Add the standards and procedures that put each policy into practice

Often it is both: we keep what works, fix what doesn't and write what's missing, so you end up with one consistent set.

What's included

The policies and plans we write and review

Pick the documents you need, or let us recommend a set based on your size, industry and obligations.

  • Core security

    • Information security policy
    • Acceptable use
    • Access control
    • Passwords and authentication
    • Data classification and handling

  • Response and continuity

    • Incident response plan
    • Business continuity
    • Disaster recovery
    • Backup

  • Third parties and cloud

    • Vendor and third-party risk
    • Cloud security
    • Remote work and BYOD

  • Privacy and AI

    • Privacy policy
    • Privacy breach response and notification
    • Acceptable use of AI

Every policy comes with the supporting standards and procedures that turn it into day-to-day practice, so your team knows not just what the rule is but how to follow it.

Frameworks and laws

Written to the requirements that apply to you

We write each policy to meet the frameworks, laws and industry rules your organization is held to, and show exactly which requirements it covers.

That means fewer surprises in an audit, faster answers to customer security questionnaires, and one set of policies that serves several requirements at once.

Security frameworks

  • NIST CSF 2.0
  • CIS Controls v8
  • ISO/IEC 27001
  • CPCSC
  • CMMC

Canadian privacy law

  • PIPEDA
  • Alberta PIPA
  • Quebec Law 25

Industry and international

  • PCI DSS
  • GDPR
  • HIPAA

How it works

From first conversation to policies in use

We work with the people who will own and follow the policies, so they fit your organization from day one.

  1. Discover

    We gather your existing policies and learn how you operate and which frameworks and laws apply.

  2. Review or draft

    We review what you have and draft what is missing, tailored to your organization.

  3. Workshop

    We walk through the drafts with your team and refine them until they match how you work.

  4. Finalize

    You receive final policies ready for approval, with supporting procedures and a framework mapping.

  5. Keep current

    An optional annual review keeps your policies up to date as your organization and the rules change.

What you receive

Documents you own and can keep current

Everything is delivered in formats you can edit, approve and maintain yourself, with help from us when you want it.

  • Editable Word documents

    Policies in editable Word format that you own, ready for your branding and approval process.

  • Supporting procedures

    Standards, procedures and guidelines that show your team how to follow each policy day to day.

  • Framework mapping

    A matrix showing which framework controls and legal requirements each policy covers, ready for auditors and customer questionnaires.

  • Annual review

    An optional yearly review that keeps your policies current as your organization, technology and obligations change.

Put your policies to work

Written by practitioners with over 20 years of experience, holdingCISSP · CISA · CISM · CGEIT · OSCP · OSWP · KLCP · ECIH

Get started

Request policy review or development

Tell us what you have today and what you need. We'll recommend a set of policies and send you a quote.

  • A recommended set of policies for your organization
  • A scope and quote based on the documents you need
  • Prefer to talk first? Choose the call option and book a 45-minute call
Your policies

A few questions so we can recommend the right set of policies.

How would you like to start? (required)

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

What do you need? (required)

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

Which policies are you interested in? (required)

Choose all that apply.

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

Which frameworks or laws should they meet?

Choose all that apply.

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

What's driving the assessment?

Choose all that apply.

About you

Who we'll be working with.

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

Anything that helps us scope the work, such as how many policies you have today, an audit date or a customer deadline.

Answer only if you chose “Skip the questions and book a 45-minute call with us” for “How would you like to start?”.

Choose a time for your call (required)

Times are shown in your time zone. We'll send a Microsoft Teams invitation to your email.

To choose a time without JavaScript, use the booking page.

FAQ

Questions about security policies

Can't we just use a policy template?

Templates are a starting point, but they rarely match how your organization actually works, and auditors and customers notice when written policies aren't followed. We tailor each policy to your operations so it is accurate and usable.

Can you review the policies we already have?

Yes. We compare your existing policies against the frameworks and laws that apply to you, check them against how you really operate, and recommend changes. We can then update them for you.

Which frameworks and laws can our policies map to?

NIST CSF 2.0, CIS Controls v8, ISO/IEC 27001, CPCSC and CMMC, Canadian privacy law including PIPEDA, Alberta PIPA and Quebec Law 25, and industry and international rules such as PCI DSS, GDPR and HIPAA.

What format will we receive?

Editable Word documents that you own, with supporting procedures and a framework mapping that shows which requirements each policy covers.

How often should policies be reviewed?

At least once a year, and whenever your organization, technology or legal obligations change significantly. Our optional annual review keeps them current.

How do we get staff to follow them?

Clear, plain-language policies are the first step. Our End-User Training helps your team understand the policies that affect them.