Cyber Correlate

Englishالعربية Soon
Under attack?
Policies & procedures · Governance documentation

Every control you own is somebody’s personal habit until it is written down.

We review the governance documentation you already have, develop what is missing, and align the whole set to the standards and regulations that actually apply to you, in language your staff will follow and an auditor will accept.

Aligned to
Central Bank of Jordan requirements
ISO/IEC 27001:2022
PCI DSS and PCI-S3
Personal Data Protection Law
Contractual and client obligations

One set of documents, mapped to every framework at once. Writing separate policy sets per standard is how organisations end up with three that contradict each other and none that anyone reads.

Why governance matters

Four reasons this is not administrative overhead

Documentation has a reputation as the least interesting part of security. It is also the part that determines whether anything else you buy keeps working.

A control without a policy has no owner

Policy is where accountability is assigned. Without it, a control exists because one engineer configured it and stays until that engineer leaves.

Auditors test documents against practice

Every assessment compares what you wrote down with what you do. Two gaps are possible, missing documentation, or documentation nobody follows, and both are findings.

Decisions stop being re-argued

A documented exception process, access standard or retention period ends a debate permanently. Undocumented ones are relitigated every quarter.

It survives the people who wrote it

Governance is what turns individual knowledge into organisational capability. Staff turnover should not reset your security posture.

The hierarchy

Four layers, and most organisations collapse them into one

The common failure is a forty-page “policy” containing board position, technical parameters and step-by-step instructions together, so it cannot be approved, followed or updated without touching all three.

Policy
What the organisation requires and why
Approved at board or executive level. Short, stable, and rarely changed, it states position and assigns accountability.
Standard
The specific rule that must be met
Measurable and technology-specific. Minimum password length, encryption algorithm, patch window, log retention period.
Procedure
Who does what, in what order
Step-by-step, with roles, inputs, approvals and records. The document somebody actually follows during the task.
Guideline & record
Recommended practice, and the evidence
Non-mandatory guidance, plus the forms, registers and logs that prove the procedure ran.
Service

Six steps, starting with what you already have

Most organisations have more documentation than they think and less coverage than they need. We start by finding out which, rather than by writing.

01
Review what exists
Every current policy, procedure, standard, form and register collected and assessed for completeness, currency, internal consistency and alignment with the requirements that apply to you. Duplicates, contradictions, orphaned documents and unapproved drafts identified.
02
Map the requirements
The documentation each applicable framework and regulation actually demands, consolidated into one list, because CBJ, ISO 27001 and PCI DSS overlap heavily and writing three separate sets is how organisations end up maintaining none.
03
Identify the gaps
What is missing, what is outdated, what conflicts, and what exists but was never approved, communicated or version-controlled. Presented as a register with priority rather than a critique.
04
Develop and revise
New documents authored and existing ones rewritten against your operating reality, not a template with your logo on it. Roles, approval authorities, workflow steps, records and retention defined inside each procedure.
05
Approve and communicate
Review cycles run with document owners, formal approval obtained at the right level, then publication, version control and the awareness activity that makes staff aware the document exists.
06
Maintain
A review cadence, ownership per document, change control, and a register that shows what was approved when and by whom. This is the part that decays first and the part auditors check.
Alignment

One document set, mapped to every requirement

Central Bank of Jordan

Requirements interpreted for your licence type and size, with the documentation the supervisor expects to be shown during a review.

Read more →

ISO/IEC 27001

The documented information the standard requires, plus the Annex A controls that are satisfied through policy rather than technology.

Read more →

PCI DSS

The policy and procedural requirements sitting alongside the technical ones, frequently the part that fails an assessment.

Read more →

Data protection law

Notices, retention schedules, subject rights procedures and processor terms, aligned to statutory obligation.

Read more →

Coverage

Eighteen documents most regulated organisations need

Which apply depends on your scope and obligations. The gap analysis establishes the list before anything is written.

Information security policyThe apex document. Position, scope, objectives and accountability.
Acceptable useWhat staff may and may not do with organisational systems and data.
Access controlProvisioning, review, revocation, privileged access and segregation of duties.
Data classification & handlingSensitivity levels and the handling requirements attached to each.
Cryptography & key managementApproved algorithms, key lifecycle and where encryption is mandatory.
Change managementCategorisation, approval, testing, emergency changes and roll-back.
Incident responseDetection, classification, escalation, notification obligations and post-incident review.
Business continuity & DRContinuity strategy, recovery objectives, plan maintenance and testing.
Backup & recoveryScope, frequency, retention, offsite storage and restoration testing.
Third-party & outsourcingDue diligence, contractual security terms, monitoring and exit.
Human resources securityScreening, terms of employment, awareness obligations and leaver process.
Physical & environmentalPerimeters, access authorisation, visitor control and equipment security.
Logging & monitoringWhat is logged, retention, protection from tampering and review obligations.
Vulnerability & patch managementScanning cadence, remediation SLAs and exception handling.
Secure developmentRequirements, secure coding, testing gates and environment segregation.
Personal data protectionLawful basis, consent, subject rights, retention and cross-border transfer.
Risk managementMethodology, criteria, treatment options, ownership and reporting.
Exception managementHow a deviation is requested, approved, time-boxed and reviewed.
Approach

Written for your organisation

Documents reflect how you actually operate, reference your real systems and roles, and are sized to your maturity. A template set with your logo applied fails the first time an auditor interviews a member of staff about it.

Internal audit & readiness →

Afterwards

Maintained, not just delivered

Ownership per document, a defined review cadence, change control and an approval register. Where you would rather not carry that internally, we hold it as part of an ongoing arrangement.

vCISO and ISO as a service →

Related

What the documents govern

Risk assessment

The register the policy set exists to treat, with owners and ratings.

Data classification

Handling requirements in a policy only mean something once data has been classified.

Security awareness

A policy nobody was told about is not a control. Attestation records are the evidence.

Send us what you have.

We review your existing documentation against the requirements that apply to you and hand back a gap register. It is the cheapest way to find out where you stand.