Top-level security policy
A concise statement the directors sign: goals, what it covers, who is responsible and when it is reviewed. It is the yardstick for every other document, not a list of aspirations.
Service · Cybersecurity
Security policies and documentation
Nobody writes security documents for fun. There is always a trigger. An automotive parts maker in Novo mesto gets a hundred-item security questionnaire from a carmaker's tier-one supplier, due in a fortnight. A company servicing IT for an energy or healthcare operator finds that its client has pushed duties arising from the NIS2 directive and ZInfV-1, the Slovenian information security act, into the supply contract. A broker renewing cyber cover asks to see an incident plan. In the rush, someone downloads a template and fills in the blanks, and any seasoned assessor notices within minutes: references to systems the firm never bought, job titles that do not exist, procedures staff have never seen. Our approach starts at the opposite end. We learn how your business genuinely operates, decide together which practices deserve to become rules, and note the weaknesses that surface so they can be fixed. What you end up with passes an assessment and reads like a description of your own company.
ISO 27001
used as a structure, certification optional
NIS2 and ZInfV-1
duties that frequently reach you through clients
Up to 4 pages
for the top-level policy the directors sign
Yearly
review so nothing goes stale
Scope of the service
Depth follows purpose. Answering one client questionnaire rarely needs much. A business that could itself be classed as essential or important under NIS2 needs a fuller set and visible ownership by the directors.
Assets and risk register
What matters most to the business, what could hit it, how probable that is and what it would cost. We score this with you through real scenarios, like the planning system in a factory failing or a solicitors' office losing client files.
Rules people will read
Sign-in and passwords, phones and tablets, home working, mail and file exchange, generative AI. Every rule fits on a page and names the person to contact with questions.
Procedures for bad days
Handling incidents, notifying SI-CERT or the competent body where required, restoring data, joiners and leavers, supplier oversight. Laid out as concrete steps with names, time limits and contact routes.
Client questionnaires
We fill in big customers' questionnaires with references to your actual documents. Where a truthful “yes” is not yet possible, the item turns into a task with someone responsible and a target date.
Framework comparison
Your documentation is set against ISO 27001 controls, NIS2 expectations or the scheme your customer names. A single matrix shows coverage and gaps.
How the work runs
Typing up text is quick. Discovering what your company really does takes longer.
01
Conversations
Between two and four video sessions with directors, the IT lead and team managers. Our questions are practical: who creates logins for new starters, what follows a lost laptop, who has the final word during an outage.
02
Scoring risks
Together we rate the main assets and threats in an uncomplicated sheet that you can maintain on your own later.
03
Drafting and review
Drafts go to the people who will live with them, one conversation at a time. If a clause would not survive real life, we rewrite it rather than polish it.
04
Approval and diary
Directors approve, employees are informed and next year's review is booked. Updates can be handed to us if you wish.
Assessors check whether policies are lived, not only whether they exist. Requiring twelve-character passwords on paper while the system allows eight does more harm than silence, because the weakness is now documented in your own words. Each document is compared with the real configuration before approval.
Your questions answered
Obligations fall on entities classed as essential or important, mainly according to sector and size. Even outside scope, you may meet the same expectations through a customer who is in scope, in the form of questionnaires, contract terms or audits. An indicative assessment from us is possible; the authoritative answer comes from counsel.
Something you can actually maintain: a top-level policy of three to four pages, between five and eight short rules, one risk table, plus a handful of procedures covering incidents and recovery. Piling up paperwork adds no protection.
Yes. Our documents are modelled on ISO 27001 and arranged to form the backbone of an information security management system. Only an accredited certifier can carry out the audit, and Apply does not hold that role.
Each document names an owner and a next review date. The annual check can be ours, or yours using the list we provide. Any additional time costs €50 per hour plus VAT, quoted in advance.
More services in this area
Service
GDPR and data protection
Processing records, processor contracts, safeguards and a ready plan for when a breach happens
Service
Security tooling roll-out
Choosing, trialling and deploying protection remotely
Service
Infrastructure security
Perimeter clean-up, network zoning and controlled outside access
Service
Application security
Least-privilege roles, per-integration accounts and safe handling of API keys
Documents that hold up under review
Explain what has prompted the need and what documentation exists already. We will suggest a scope proportionate to your size.
When we work
Weekdays 9:00-17:00 CET, answers the same or next working day
Weekdays 9:00-17:00 CET, answers the same or next working day
Calls
Video meetings, Teams and Meet both welcome
Video meetings, Teams and Meet both welcome
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
- Questions first. If something is missing before we can estimate, we email you or set up a brief video chat.
- A written quote. It spells out the work, a euro figure excluding VAT and a sensible start date. No fine print, no surprise line items down the road.
- You choose. It lands in your mailbox. Read it at your own pace, query anything that seems vague, and only then make up your mind.