Security Policy and Framework Development

Regulatory, contractual and customer security obligations are gathered into one register, which usually reveals overlapping requirements that a single control set can satisfy.

Deliverables:

• Obligation register
• Applicability analysis
• Framework decision

Controls are implemented so that tickets, logs and approvals generate their own evidence continuously, rather than being reconstructed the week before an audit.

Deliverables:

• Evidence pipelines
• Control instrumentation
• Evidence calendar

Assets, threats and existing controls are assessed to produce a ranked risk register scored in business terms, with treatment decisions recorded and owned.

Deliverables:

• Risk register
• Scoring methodology
• Treatment decisions

Internal audit or a mock assessment tests each control against its evidence, and findings are closed while they are still private.

Deliverables:

• Internal audit report
• Corrective actions
• Readiness assessment

Policies and standards are written to be followed, mapped to the chosen framework, and scoped so exceptions are rare enough to be meaningful.

Deliverables:

• Policy set
• Control mapping
• Exception process

Risk, control coverage and incident metrics are reported to leadership on a fixed cadence, and the register is revisited as the business changes.

Deliverables:

• Board reporting pack
• Metrics
• Review cadence