glacierr
glacierr
service · 03iso/iec 27001:2022 aligned
clear requirements, written down.
We develop a tailored cybersecurity policy framework aligned to ISO/IEC 27001:2022 — setting clear security requirements, defining responsibilities and giving your security programme the documented governance it needs.
a framework built from scratch
a gap analysis and refresh of what you already have
built on ISO/IEC 27001:2022 policy requirements
01what changes for you
Requirements the business has agreed, owners who review them, and documents people can actually follow.
What good looks like, written down and agreed across the business.
Named policy owners, approvers and review cycles.
A clear hierarchy linking policies, standards and procedures.
Mapped to ISO/IEC 27001:2022 to support compliance readiness.
Written for your organisation, risks and ways of working.
Plain-English policies staff can follow — not shelfware for the auditor.
02what we typically find
Policies written years ago, copied from templates or scattered across SharePoint. Owners have moved on, requirements contradict each other, and the next audit exposes the gaps. Two routes in: build a new framework from scratch, or review and update the policies you already have.
03our approach
Five stages, each with a gate you sign — from understanding your context to policies agreed and adopted. Senior consultants only.
understand your context
review what exists
design the framework
draft the policies
agree and adopt
04what you get
Tailored to your route and scope.
05who it's for
A framework to govern the programme.
Clear requirements for the teams that build.
Owned, reviewable policy documents.
Governance evidence for audit and assurance.
Sources: DSIT, Cyber Security Breaches Survey 2025/26 (30 April 2026).
Scoped to your organisation, starting point and standards — fixed scope, fixed fee. A policy nobody can follow doesn't protect anyone.