Remote GRC service
Security Policy Writing Services
Information security policy writing: a top-level policy, topic-specific policies, standards and procedures mapped to ISO 27001, NIST CSF and GDPR, with owners, review cycles and an exceptions process.
Policies copied from a template rarely match how a business works, so they are ignored until an audit. Good policies are short, specific, approved by the right people and connected to the controls and evidence that prove they are followed.
Ian writes and maintains security policy frameworks that fit the organisation, map to the frameworks you report against and stay current. Available as a consulting project, a fixed-term contract or as part of a full-time remote role, depending on what your organisation needs.
Who it is for
- Organisations without a written policy set, or with one that is outdated or inconsistent.
- Teams preparing for ISO 27001, SOC 2 or customer audits.
- Companies adopting AI tools that need an acceptable use policy.
What is included
- Information security policy approved by leadership.
- Topic-specific policies: acceptable use, access control, data classification, incident response, supplier security, backup and continuity.
- Standards and procedures where measurable rules are needed.
- Policy register with owners, approvers and review dates.
- Exceptions process and policy acknowledgement workflow.
- Mapping from each policy to ISO 27001, NIST CSF 2.0 and GDPR requirements.
How it works
- 1Review. Read existing documents, interview owners and confirm the frameworks that apply.
- 2Draft. Write clear policies using a consistent template, with must and should language and named roles.
- 3Approve. Walk owners and leadership through each document and record approval.
- 4Embed. Set up acknowledgements, training links, review dates and the exceptions process.
Frequently asked questions
How many security policies does a small business need?
Usually a top-level information security policy plus five to ten topic-specific policies, which small organisations can combine into fewer documents. What matters is coverage of your risks and clear ownership.
How long should a security policy be?
As short as possible while still being clear. Most topic-specific policies fit on two to four pages, with technical detail moved into standards and procedures.
Free resources
Work together
Share your role, contract or project and Ian will reply by email to discuss scope and timing.
Go to the request form