Policy & procedure development

Practical, implementable policies — not boilerplate Word docs from 2019. Customized to your environment, framework-aligned, and written in plain language your engineers and auditors can both follow.

Policies that hold up under real scrutiny

Policy programs fail when they are generic. Auditors can tell. Enterprise buyers can tell. We write policies that reflect how your company actually operates, which means they hold up under scrutiny and your team can actually implement them.

Important: Policy updates triggered by new regulatory requirements are not included as minor updates — they are scoped and quoted as change orders.

Pricing tiers

Starter

$3,500–$5,500

one-time · 18–28 hrs · 2–3 weeks

Overage: $185/hr · 1 review call + 2 revision cycles

10 foundational policies (customized, not templates)
Acceptable Use, Access Control, IR, Data Classification, Business Continuity, Vendor Mgmt, Password, Encryption, Remote Work, Asset Management
Policy acknowledgment tracking template
GRC platform upload (Drata or Vanta)

Growth · Most popular

$7,000–$10,500

one-time · 38–55 hrs · 3–5 weeks

Overage: $185/hr · 1 policy refresh at 6 months (editorial only)

Everything in Starter
25+ policies (full SOC 2 or ISO 27001 requirements)
Procedures for each policy (operational runbooks — how, not just what)
Role-based policy matrix (owner assignments)
Policy exception and waiver process + templates
Annual policy review schedule
Staff-ready policy summaries (plain language)

Professional

$10,500–$17,000

one-time + 1-year editorial maintenance · 60–90 hrs · 4–6 weeks

Overage: $195/hr · Regulatory rewrites scoped separately

Everything in Growth
Multi-framework alignment (SOC 2 + ISO 27001, or + HIPAA)
Policy gap analysis against current controls
Policy exception log and tracking workflow
Board/executive policy approval workflow
Custom policy branding and formatting
1 year editorial maintenance included (corrections only)

Enterprise

$17,000–$26,000

one-time + quarterly retainer · 95–130 hrs initial · ~6 hrs/quarter

Overage: $225/hr · Legal firm fees are client-paid

Everything in Professional
Full governance framework (policy → procedure → standard → guideline hierarchy)
Regulatory-specific addenda (HIPAA, GDPR, SOC 2, ISO 27001, ISO 42001)
Legal and compliance review coordination
Board governance documentation package
Annual regulatory change impact assessment

Bundle recommendation

Training is most effective when staff are trained on the policies they are acknowledging
Bundle with Security Awareness Training for maximum impact

Policies your team can actually follow.

Bundle with Security Awareness Training — and add tabletop exercises to stress-test whether the training has changed behavior when it matters most.