Услуга · Information security

Organisational and administrative documentation

We write the documents from how things actually work at your company. A set downloaded from the internet looks solid right up to the first follow-up question: show me the log, show me the signatures, show me the order of appointment.

In practice
not from a template
3-4 weeks
the usual set
Workable
checked against practice
Briefing
we run it ourselves

What the work includes

The set is determined by what you are covering: the personal data law, industry requirements or your own procedure. It usually comes to ten or fifteen documents.

Discuss the scope

Policy

A top-level document: what we protect, from what, and where responsibility lies.

Orders

Appointing the person responsible for processing, the composition of the commission, the list of authorised staff.

Access rules

Who receives which rights, how the granting is recorded and how it is all revoked on departure.

Procedures

Media, passwords, remote work, the procedure to follow during an incident.

Guides

Short and clear, not thirty pages that nobody will ever open.

Record forms

Logs of media, of citizen requests, of briefings. Those are exactly what you are usually asked to produce.

How it goes

The main requirement of the set is that it can be followed. A document that contradicts the working process will be breached in the first week.

01

We study the processes

How it all works: who grants access, what happens on departure, where the passwords are kept.

02

We write

We prepare the set and agree wording that the company will actually be able to follow.

03

We put it into force

Approval, acknowledgement by signature, briefing of staff.

04

We update it

We review it once a year: systems, structure and responsible people all change.

Acknowledgement sheets go missing more often than the documents themselves. The policy is approved, the order is signed, and there is nothing to prove the staff ever read them. Signatures are collected once at rollout and then with every new hire, otherwise within a year the set is useless again.

Questions and answers

A designated person inside the company. We hand over not only the texts but the way to work with them: when to update, whom to brief, where to keep the signatures. Without a designated person the set goes stale within a year.

Once a year as a matter of routine, and out of turn on significant changes: a new system, a new department, a change of responsible person, changed requirements. A review usually means amending a few clauses rather than rewriting.

The designated person, the policy, the consents and the logs. They do not always get as far as technical measures: if the basic paperwork is not in order, the findings start there.

We will prepare the document set

Write what needs covering: the personal data law, a client requirement or your own procedure. We will propose the contents and a timeframe.