Services
Security Policy, Standards and Awareness
Security rules written for how your business really works, and staff who understand them.
When you need it
You need rules people follow.
-
Your customer
"Send us your security policies."
You geta complete, current set you can send.
-
Your auditor
"When were these last reviewed?"
You getversion control and a review schedule.
-
Your staff
"What am I supposed to do?"
You getshort, clear rules and training that sticks.
-
Your managers
"Can we make an exception?"
You geta simple way to ask, approve and track exceptions.
What you get
Rules that fit your business.
-
A full policy set
Approved, dated and easy to read.
-
How-to standards
The practical steps behind each rule.
-
An exceptions process
So rules bend in the open, not in secret.
-
A training plan
For leaders and for every employee.
How it works
Simple, start to finish.
-
We review what you have
And keep what already works.
-
We write what's missing
In plain language your team will read.
-
We train and review
Staff training now, and a yearly review after.
Questions
Policy questions, answered.
How many policies do we actually need?
Fewer than most templates suggest. Usually a short core set, plus the standards that make them work.
Can you use policies we already have?
Yes. We keep what fits and rewrite what doesn't.
How do we know whether awareness training is working?
Watch behavior, not quiz scores: who reports suspicious email, and whether the same mistakes keep happening.
Insights
Related reading.
-
Governance
What Security Documentation an Assessor Requests First and Why It Matters
Before a SOC 2, ISO 27001 or HITRUST assessment begins, an assessor requests specific documentation in a predictable sequence. Leadership must understand what gaps stop an assessment entirely, what can be addressed during fieldwork, and what delays certification. This article explains the documentation sequence, identifies who owns each category, and clarifies what adequate preparation looks like.
Dr. Daniel Glauber, 19 August 2026
-
Compliance
What Sarbanes-Oxley IT General Controls Actually Require and How They Are Tested
Public company executives are accountable for IT general controls under Sarbanes-Oxley Section 404, yet many face audits without clarity on what is tested, what constitutes a deficiency, or who owns the outcome. This article explains what auditors examine, what delays sign-off, and how vCISO leadership provides the executive ownership needed to close this gap.
Dr. Daniel Glauber, 17 August 2026
Let's talk.
Need policies you can actually hand to a customer? Book a call. We'll tell you where you stand and what it takes.