Policies and WISP
Policies and Written Information Security Programs
Policies written for how you actually work, not a template with your name on it.
- Written information security program (WISP)
- Acceptable use, access control, incident response, backup and vendor management policies
- Staff acknowledgment tracked in Compliance Scorecard
- Training courses built from your own policies (see Awareness Training)
- Annual review and update
Who needs written policies
Healthcare practices, banks, auto dealerships, tax and accounting firms, local governments, and any organization whose cyber-insurance carrier asks for them. Regulators and examiners expect written policies, proof that staff have read them, and evidence that you follow them.
How we write them
- Review: we start from the policies you already have and the requirements that apply to you.
- Interview: we learn how your organization actually operates, so the policies describe real practice.
- Write: missing policies are written and outdated ones revised.
- Approve: your leadership reviews and approves the final set.
- Acknowledge and train: staff acknowledge the policies in Compliance Scorecard, and training courses are built from them.
- Maintain: the full set is reviewed and updated every year.
Frequently asked questions
What is a WISP?
A written information security program: the document that describes how your organization protects the information it holds. The FTC Safeguards Rule requires one for dealerships and other non-bank financial businesses, and the IRS expects one from tax professionals.
Can we just use a template?
A template describes someone else’s organization. Examiners look for policies that match how you actually operate, and that your staff follow.
How long does it take?
It depends on the size of your organization and how many policies you already have. We give you a schedule with the quote.