Security policies and procedures
Documents you can work by, not just show to an auditor. Each has an owner, a review date and a link to a real process.
Built for ISO 27001NIS2 DORA
- Information security policy
- Access management procedure
- Incident management procedure
A policy your team can read and apply
A policy nobody has read adds no security. We prepare documents that meet regulatory requirements and at the same time describe how your company really works.
We start with what already happens in practice and only then describe what needs to change. That keeps the document alive, instead of an attachment you only remember before an audit.
Which documents we prepare
The set that auditors usually ask for, and that your team can actually use.
Information security policy
Access management procedure
Incident management procedure
Backup procedure
Business continuity plan
Supplier management procedure
Employee rules
Review and updates
Frequently asked questions (FAQ)
Can't we just use templates from the internet?
You can, but auditors recognise them quickly, and such a document does not help your team. A template describes a generic company, not your processes, so in practice it is not followed, and that is exactly what becomes a problem during an audit.
How many documents do we actually need?
Fewer than is often assumed. For most companies a few core documents covering access, incidents, backups and employee rules are enough. The number of documents is not a measure of compliance. What matters is that they match real operations.
Who writes the documents, you or us?
We write them, based on conversations with your team. We need your time for a few interviews and a review before approval. Your management approves the final document, because accountability stays with the company.
Do you help put them into practice?
Yes. A document without an introduction to the team does not work, so we prepare a short presentation for your team and, if needed, technical controls that ensure the described procedure is followed automatically.
Related services
Virtual CISO solution:
MDP CLOUD vCISO is an experienced chief information security officer (CISO) on demand: risk management, policies, control implementation, training…
DORA implementation from A to Z
We will help you implement DORA, from policies to deploying security solutions.
Expertise confirmed by certifications
This service is delivered by specialists with valid international certifications. Their expertise is confirmed by independent organisations, not by us.
-
ISO/IEC 27001 Lead Implementer
The service is delivered in line with the requirements of an ISO/IEC 27001 management system.
-
Certified Information Security Manager
Security governance, policies and incident processes following the ISACA methodology.
We will prepare your security documentation
We reply within 1 business day