Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Policy and governance

Which documents you need, who approves them, and how to keep them current and acknowledged.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we separate what belongs in a policy, a standard and a procedure?
  2. How do we write a policy statement that an auditor can test?
  3. How do we decide which policies we actually need, for our size and regulation?
  4. How do we get staff to acknowledge policies, and chase those who don't?

When do we…

Triggers and timing: when something has to happen.

  1. When does a policy change need re-approval and fresh acknowledgement?
  2. When do we retire a policy rather than update it?

Who decides…

Authority: who may approve, accept or act.

  1. Who approves a policy, a standard and a procedure?

If…, then how…

Situations: something has happened, what now.

  1. If half of our policies are past their review date, then how do we recover?
  2. If our IT is run by a service provider, whose policies apply?
  3. If we are a NIS2 or DORA entity, what changes in how policies are governed?

Other categories