Skip to content
Book a risk assessment

Policy Kit.

Policies written about your business.

Six core policies, pre-filled from your Groundwork answers and mapped to the frameworks clients, insurers and auditors ask about. Each one has a named owner and a review date.

Price
$990 one-off, up to 50 people
Starts
After Groundwork, from your answers
Mapped to
ISO/IEC 27001, NIST CSF 2.0, Essential Eight
Start with Groundwork See the six policies
Example · Northbank Advisory · Policy 3 of 6Version 1.0 · Draft for approval
Incident response policy
Owner
Priya, Director
Review
Every 12 months, and after any incident
3 · Who does what
  • Leads the responseSam, IT admin
  • Decides on shutdowns and disclosurePriya, Director
  • Calls in outside helpManaged IT provider, Rapid Response
4 · Protect first
Client filesAccounting systemEmail and calendars
6 · Who must be told

Assess a suspected data breach straight away. If serious harm is likely, tell the privacy regulator and the people affected within the deadline your law sets.

Your privacy law · Breach notification
Example draft. Highlights are filled in from Groundwork answers.
What's in the kit

Six policies, each answering a question someone will ask you.

Clients, insurers and auditors ask how you handle these. Now there's a written, approved answer, with the framework references they look for.

The six policies and the frameworks they map to
Policy The question it answers ISO/IEC 27001:2022 NIST CSF 2.0 Essential Eight
Acceptable use What can staff do with company devices, data and accounts? A.5.10, A.6.7 GV.PO, PR.AT Application control, Office macros
Access Who gets access, who approves it, and when is MFA required? A.5.15, A.5.18 PR.AA MFA, admin privileges
Incident response Who leads, who decides, and who must be told by when? A.5.24, A.5.26 RS.MA Not one of the Eight
Backup and recovery What must be restorable, how fast, and how do we know it works? A.8.13 PR.DS, RC.RP Regular backups
Suppliers Which suppliers hold our data or keys, and what do we require of them? A.5.19 GV.SC MFA for supplier admins
AI use Which AI tools are approved, and what never goes into them? A.5.10, A.5.12 GV.PO, PR.DS Not one of the Eight
The set as a whole covers ISO/IEC 27001 A.5.1 and NIST CSF GV.PO. Policies set the rules. Hardened, Fix First and Device Shield enforce them.
Pre-filled

You answered once, in Groundwork. The first draft already knows your business.

Names, systems and suppliers come straight from your answers. You review and approve. Nobody starts from a blank page.

  1. Groundwork asked
    Who makes the call in a crisis?
    Priya, Director
    Lands in · Incident response, section 3

    Decides on shutdowns and disclosure: Priya, Director

  2. Groundwork asked
    What would hurt most to lose?
    Client files, accounting system, email
    Lands in · Backup and recovery, section 2

    Restore in this order: client files, then the accounting system, then email.

  3. Groundwork asked
    Who else holds admin access?
    Managed IT provider
    Lands in · Suppliers, section 4

    Managed IT provider uses named admin accounts and phishing-resistant MFA.

  4. Groundwork asked
    Which AI tools do staff use?
    A chat assistant and a meeting note-taker
    Lands in · AI use, section 2

    Review before approval: chat assistant, meeting note-taker. Never paste in client files, tax file numbers or passwords.

Owners and review dates

Every policy has an owner, a version and a review date.

ISO/IEC 27001 expects policies to be approved, communicated, acknowledged and reviewed. The register in your portal keeps track of all four.

Policy register · Northbank Advisory Portal · Example
Example policy register
Policy Owner Version Status Next review
Acceptable use Priya 1.0 Approved Nov 2027
Access Sam 1.0 Approved Nov 2027
Incident response Priya 1.1 Approved
Updated after a tabletop exercise
 Nov 2027
Backup and recovery Sam 1.0 Approved May 2027
After the next restore test
Suppliers Priya 1.0 Waiting for sign-off Set on approval
AI use Priya 1.1 draft Change proposed
New note-taking tool found in use
 Set on approval

30 days' notice

Owners get a reminder before a review is due. They confirm the policy still holds, or ask for changes.

Read and accepted

38 of 40 staff have accepted acceptable use and AI use in the Demysti5 app. Needs Habits.

Every version kept

Old versions stay in the register, so you can show what applied on any date.

Price

One-off, priced by size.

Includes all six policies, your review round and the register in your portal. Later changes are yours to make in the portal, or ours using Expert Hours.

Policy Kit price by business size
Your size Policy Kit, one-off
Up to 50 people$990
Up to 150 people$1,485
Up to 300 people$1,980
Up to 500 people$2,475

Bigger than 500? We'll price it with you.

Your Groundwork answers are the first draft of your policies.

Add Policy Kit when you book, and spend your time approving, not writing.

Book Groundwork