Privacy and GRC Advisory
Your policies, standards and procedures rewritten against the systems you run and the obligations you carry, with every interval, threshold and owner set to a real number and a real name. One intake form. You own the files, and there is no assessment: that is a separate engagement and we say so on the documents.
A template suite was bought or inherited. It is comprehensive, it is generic, and it describes an organization that is not yours. Nobody follows it because following it is not possible.
The bracketed fields are the tell. A fourteen day patch window nobody set, a review cadence nobody agreed, an escalation list with placeholders where the insurer's number should be. A policy set like that goes live already in breach of itself.
Generic clauses rewritten to name your sector, its terminology and the way you actually operate. A policy that could describe any organization describes none.
Which obligations apply, decided from your industry, geography, data types and customer base. Controls that do not apply are marked so, with the reason recorded rather than left blank.
Each control marked in scope or out, with the justification written down. An assessor asks for this before anything else.
Every interval, threshold and retention period set to a number appropriate to your size, in place of the bracketed field you would otherwise have to guess at.
Your systems named in the documents that govern them, so a reader can tell the policy was written for your estate.
Each requirement mapped to the framework a customer or an auditor is asking about, so one document answers more than one question.
Policy ownership mapped to your actual titles and reporting lines, including a fractional CISO or an MSP where that is who holds it, and the set arranged into your governance hierarchy so a policy, a standard and a procedure are not all called policy.
Remediation windows, access review cadence and retention periods set to what your team can actually sustain. A fourteen-day critical patch window you will miss every month is worse than a thirty-day one you meet, because the first is a documented breach of your own policy.
How an exception is logged, who accepts the risk and when it expires, calibrated before publication. Without it a policy set goes live already in breach of itself the first time somebody cannot meet a control.
Incident escalation paths, severities and notification lists carrying your legal counsel, your insurer's notification number, your retained responder and your executive tree, rather than bracketed placeholders nobody fills in.
The difference between a customized document and a template with your name dropped into it is whether the numbers in it are numbers you can meet.
A fourteen day critical patch window you will miss every month is worse than a thirty day one you meet, because the first is a documented breach of your own policy and the second is a policy. Every interval, threshold and retention period is set to what your team can sustain, and recorded as a decision rather than left as a default.
The same applies to ownership. Policy ownership is mapped to your actual titles and reporting lines, including a fractional CISO or a managed provider where that is who holds it, so a reader can tell who is accountable without asking.
The policy set is the first thing a customer, insurer or auditor asks for. A generic one invites a follow-up; a calibrated one closes the question.
A threshold nobody can meet is a documented failure you wrote yourself, and it is the most common self-inflicted finding in any assessment.
Ownership mapped to real titles and reporting lines, including a provider where that is who holds it. Unowned policies are unenforceable ones.
Editable documents, no platform, no license, no lock-in. The asset is yours and it does not expire with a subscription.
You tell us what prompted the question. A customer questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes establishing what applies to you and what does not. Not charged, and not a sales call: if the answer is that you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you have to supply, the fee and the end date. Nothing starts until you have it in writing.
Delivered against that scope. If something has to change, we agree it in writing first, including what it costs.
The deliverables, plus the evidence and the method, so the work can be repeated by somebody who is not us.
Fixed fee against an agreed scope. Nothing is billed hourly and the scope does not move without your written agreement. The fee is quoted rather than published, because a number carrying an asterisk is worth less than a straight answer, and scope is what decides it. You own the output. Editable files, no platform, no license, no lock-in.
No, and we say so on the documents themselves. This produces a policy suite calibrated to your organization. Whether the controls those policies describe are actually operating is a separate engagement, and conflating the two is how a folder of documents gets mistaken for a security program.
Yes. The documentation packs are the starting suite and this is the work that makes them yours. Either can be bought alone.
One intake form, thirty to forty-five minutes, plus whatever exists already. The form is the part that decides the thresholds, so it is worth answering honestly rather than aspirationally.
One round, and in practice most of the change lands in the parameters rather than the prose. If a second round is needed we will say what changed and why rather than absorbing it silently.
Assess you, audit you, or sign anything off. And if we write your policies, a later assessment of those documents says that we wrote them, because you are entitled to know which conclusions rest on our own prior work.
Read one of your existing policies and look for a bracketed field or a threshold nobody agreed. If you find one in the first page, you already know what this engagement changes.
Related services: Cybersecurity Program Development · Data Protection Compliance Program · Data Protection Impact Assessment