Policy requirements
Establish scope, obligations and the decisions each policy must support.
Security Policy Development
A cyber security policy sets out how an organisation expects its information and systems to be protected, and who is responsible. Umbrella Tech writes information security policies and supporting procedures that match your real environment and obligations, from acceptable use and access control to incident response, with owners and review dates so they stay accurate and useful as evidence.
The problem
The challenge we help you address
Generic policy templates describe controls you do not actually operate. That confuses staff, creates gaps between what you say and what you do, and weakens evidence for an audit or customer review.
The outcome
What the engagement should deliver
A coherent, approved set of IT security policies and procedures that staff can follow, each with an owner and review date. Where a policy describes a control you do not yet have, the gap is recorded as an implementation action rather than hidden.
How we can help
Policy set
Write or revise an information security policy and topic policies such as acceptable use, access control, data handling, backup and incident response.
Practical procedures
Connect each policy with the workflows and systems your team uses, such as Microsoft 365 and device management.
Framework mapping
Show how the policies support ISO/IEC 27001, SMB1001, the Essential Eight or other requirements.
Adoption and review
Assign owners, approval, communication and a review cycle.
How we deliver
How the work runs
01
Gather requirements
Review obligations, existing documents and how the environment actually works.
02
Draft
Write concise policies and procedures in plain language, with your team's input.
03
Approve and publish
Take the set through approval and make it easy for staff to find.
04
Embed
Brief staff, record acknowledgement and schedule reviews.
Frequently asked questions
Can't see your question? Ask us directly →
What is a cyber security policy?
It is a management-approved statement of how information and systems must be protected and who is responsible. Topic policies and procedures then explain how each area works in practice.
When should a business use it?
When customers, insurers or frameworks such as ISO/IEC 27001 or SMB1001 ask for documented policies, when existing policies are out of date, or when staff are unsure what is expected of them.
What does implementation include?
Requirements gathering, drafting, review with your team, approval, publication, staff briefing and a review schedule. Gaps between policy and practice are recorded for remediation.
How long does a project take?
It depends on the number of policies, how much exists already and how quickly reviewers can respond. We confirm scope and timing in discovery.
Can you update policies we already have?
Yes. We assess their relevance, consistency and fit with current systems and obligations, then identify the revisions and supporting procedures required.
Plan the next improvement
Tell us which policies you need, who is asking for them and what already exists. We will help plan a policy set your team can use.