1. What is a Security Policy Assurance Review?

It's an independent, line-by-line evaluation of your information security and IT policy suite against defined criteria: recognised good practice (NCSC guidance, ISO/IEC 27001:2022, Cyber Essentials), regulatory frameworks (DORA, NIS2, FCA expectations, the NCSC CAF), and internal consistency across the suite. Every finding is traceable to an exact document location, priority-rated, and paired with practical remediation. Strengths are formally credited alongside gaps.

2. How is this different from an audit?

An audit renders a verdict against a fixed standard; assurance evaluates against criteria to help you improve. The review is collaborative and blame-free: no pass/fail, no grading of individuals, and explicit credit for what's already working. It gives you a defensible, independent evidence base without the adversarial dynamic of an audit.

3. Which frameworks do you benchmark against?

DORA and its ICT risk-management technical standard (RTS (EU) 2024/1532), NIS2 and the UK's incoming Cyber Security and Resilience regime, FCA expectations (SYSC, PS21/3 / SYSC 15A, record-keeping, SM&CR, and the PS26/2 reporting regime from March 2027), the NCSC Cyber Assessment Framework (CAF), ISO/IEC 27001:2022, current NCSC guidance, Cyber Essentials, and UK GDPR / DPA 2018 where personal data is involved. The benchmark set is tailored at scoping to your sector and obligations.

4. We're a UK firm not directly in scope of DORA. Why benchmark against it?

DORA is the most detailed statement anywhere of what good ICT policy content looks like including approval by the management body, review cycles, exception handling, logging, access and patching specifics. Applying it as a benchmark baseline means a suite that stands up to DORA will stand up to FCA scrutiny, CAF assessment and ISO certification with margin to spare. And if you ever acquire EU exposure, the work is already done.

5. What does "traceable to an exact location" mean?

Every finding carries a locator: the section, paragraph and page it relates to. Where applicable, the specific regulation article or standard clause it's benchmarked against is also provided. You can open your document at the cited location and verify the finding yourself, and your teams can fix it without guessing what we meant.

6. Do you only report problems?

No, and this matters. Strengths are recorded with the same rigour as gaps and explicitly marked. A review that only lists faults demoralises the team that has to act on it and misrepresents your true position. Crediting strengths produces a fair picture, protects what's working, and gives boards a balanced view.

7. How much of our team's time does it take?

Almost none. You provide the policy documents; we do the rest. The only time commitments are a short scoping call at the start and a findings walkthrough at the end. There are no workshops, interviews or system access requirements.

8. What do we receive at the end?

A structured findings tracker: one review sheet per policy, each finding with locator, explanation, standard/regulation reference, priority (High/Medium/Low), and practical remediation; a summary dashboard with findings counts by policy and priority; and a client status column (Open/ WIP/Closed/N/A) that is yours to maintain as your permanent remediation record. We walk your team through it so nothing is left ambiguous.

9. How many policies can be reviewed, and which should we include?

A typical engagement covers five to fifteen documents, commonly passwords, privileged access, malware/anti-virus, asset management, data classification, acceptable use, remote/mobile working and incident-related policies. We agree the set at scoping. Reviewing policies as a suite matters: many of the most valuable findings are cross-policy inconsistencies that single-document reviews cannot catch.

10. What kinds of findings should we expect?

Typical findings include governance gaps (blank approvals, stale review dates, version/filename mismatches, undefined approval authorities), internal contradictions (must vs should, exceptions that undercut prohibitions, cross-references to sections that don't exist), benchmark gaps (missing MFA coverage, undefined patching escalation, absent log-retention and tamper-protection requirements), and drift from current guidance (legacy password complexity and expiry rules). You should also expect genuine strengths to be identified and credited.

11. How often should policies be re-reviewed?

Annually as a baseline, most frameworks, including DORA's technical standards and ISO 27001, expect at least annual review, and sooner after material change: reorganisation, new systems, new regulatory obligations (such as the FCA's 2027 reporting regime), or a significant incident. A re-review also evidences closure of previous findings, completing the assurance loop.

12. How does this relate to your resilience assessments (TRA and ORA)?

They answer different questions. The Security Policy Assurance Review evaluates what your documents say — whether your written control environment is complete, consistent and aligned to frameworks. The Technical and Operational Resilience Assessments measure what your organisation can actually do under disruption. The strongest assurance position combines both: policies that stand up to scrutiny, and evidence that the capability behind them is real. Many clients run the policy review first, remediate, then validate capability with a TRA or ORA.

World-Class Cybersecurity Professionals at your Service

Security Policy Assurance Review

Your policies, independently evidenced.

A line-by-line assurance review of your security policy suite — strengths credited, gaps prioritised, every finding traceable to the exact page and the exact standard.

What Is a Security Policy Assurance Review?

A Security Policy Assurance Review is an independent, structured evaluation of your information security and IT policy suite against defined criteria: recognised good practice (NCSC guidance, ISO/IEC 27001:2022, Cyber Essentials), regulatory expectations (DORA, NIS2, FCA rules, the NCSC Cyber Assessment Framework), and, critically, against itself, because a policy suite that contradicts itself protects no one.

It is assurance, not audit. There is no pass/fail verdict and no blame. Strengths are explicitly credited alongside gaps, because knowing what already works is as valuable as knowing what doesn't — and because teams engage with findings they recognise as fair.

What makes the review different is traceability. Every observation is anchored to a specific location in your document — a section, a paragraph, a page — and, where applicable, to the specific clause of the standard or article of the regulation it relates to. Not "your access control policy is weak", but "section 2.2, paragraph 5: the password-sharing exception undermines individual accountability and lacks a defined approval route — see the relevant identity and access management requirements". You can verify every finding yourself, and your teams can act on each one without interpretation.

The result: A living findings tracker for your whole policy suite — priority-rated, remediation-ready, and yours to maintain as gaps are closed.

Why Should Your Organisation Do a Security Policy Assurance Review?

Policies are the layer of your security programme that regulators read first, auditors test first, and incident investigators quote back to you afterwards.

Yet in most organisations they're written once, approved (sometimes), and quietly drift out of date. Here are the main reasons organisations commission an independent assurance review.

Book A Discovery Call

Reason #1: Policies are your evidence layer

When a regulator, auditor, insurer, customer or court asks "how do you manage this risk?", your policies are the answer you point to. If they're inconsistent, unapproved, or contradict current guidance, the rest of your programme inherits the doubt.

Reason #2: It's the fastest, least disruptive assurance you can buy

The Assurance review is performed on your documents. No workshops to schedule, no systems to touch, no staff time consumed beyond providing the policy set and receiving the findings. This is the best way to get maximum assurance value per hour of your team's time.

Reason #3: The regulatory bar for policy content has risen sharply

It's no longer enough for a policy to exist. DORA specifies what ICT security policies must contain, including the date of formal approval by the management body, review cycles, documented exceptions and consequences of non-compliance. NIS2 and the UK's incoming Cyber Security and Resilience regime raise similar expectations, and the NCSC's CAF asks whether your policies are actually followed, not just written. Most policy suites were written before these expectations existed.

Reason #4: Internal inconsistency is invisible from the inside

One policy says "must", its sibling says "should". One names the Risk & Compliance Forum, another says "the appropriate governance committee". The scope section promises BYOD controls in section 2.4 — and section 2.4 doesn't define them. These inconsistencies are almost impossible to spot from inside the organisation, and they're exactly what a hostile reader — a regulator, a litigator, an attacker's counsel — will find first. An external expert's suite-level review is the only way to catch them.

Reason #5: Governance gaps hide in the document control table

Blank "Approved By" fields on policies that are demonstrably in force. Review dates that predate the document itself. Filenames that contradict version numbers. Three different committees approving different policies with no record of which owns what. These are small findings individually. Collectively they say your policy governance isn't operating effectively, which is a management-accountability problem under DORA, NIS2 and SM&CR alike.

Reason #6: Guidance evolves; policies often stagnate

Current NCSC guidance advises against enforced password complexity and forced expiry. Yet policies mandating both are still everywhere, adding user burden without security benefit. An assurance review provides an independent, structured check of your password and access policies against the latest guidance. It highlights exactly where your current approach already meets or exceeds today’s standards, so you get clear recognition for good practice, not just a list of gaps.

How the Security Policy Assurance Review Works

Scoping conversation. We agree the policy set in scope (typically 5–15 documents: passwords, privileged access, malware, asset management, data classification, acceptable use, and so on), your sector, and the benchmark frameworks that matter to you.
Independent line-by-line review. Our practitioners read every document against the agreed criteria — and against each other, checking cross-references, terminology, governance routes and control consistency across the suite.
Findings, evidenced and located. Every observation carries a locator (section, paragraph, page), a plain-English explanation, the relevant standard or regulatory reference where applicable, a priority (High / Medium / Low), and a practical remediation. Strengths are recorded with equal rigour and marked as such.
Your living tracker, delivered and walked through. Findings are delivered in a structured tracker — one sheet per policy, with a summary dashboard — including a client status column (Open / WIP / Closed / N/A) that is yours to maintain. We walk your team through the findings so nothing is left to interpretation.
Re-review to evidence progress. Once remediation is complete, a re-review (or annual cycle) evidences closure — a clean, dated assurance trail for boards, auditors and regulators.

MORE INFO

Who Is This Service For?

Any organisation whose security policies carry weight: regulated firms, suppliers to regulated firms, operators of essential services, public-sector bodies working toward CAF profiles, organisations pursuing or holding ISO 27001 certification. It's also important for any business whose customers, insurers or investors ask hard questions about governance.

Sister service for regulated financial firms: If your primary driver is FCA and DORA benchmarking specifically, see our Regulatory Alignment & Policy Review — The same rigour, aimed squarely at the regulated environment.

Companion assessments: Policies describe intent; capability is a different question.

Our Technical Resilience Assessment and Operational Resilience Assessment measure whether the resilience your policies describe actually exists in practice.

BOOK A DISCOVERY CALL

security policy assurance review applicability

Key Benefits of the Security Policy Review

Book a Scoping Call

Defensible evidence, on demand

Show a regulator, auditor, insurer or major customer an independent, dated, criteria-based assurance review of your policies.

Catch what insiders can't see

Internal contradictions, governance gaps and stale guidance surfaced by fresh, expert eyes.

Zero operational disruption

The Policy Assurance review runs on documents, not on your people's calendars.

Fix the right things first

Priority ratings and wording-level remediation turn a review into a work plan.

Balanced by design

Strengths credited, so the output builds confidence rather than just cataloguing faults.

A permanent improvement record

The tracker becomes your ongoing register of policy assurance, re-usable at every audit and renewal.

Framework-ready

Findings already mapped to DORA, NIS2, FCA, CAF outcomes and ISO 27001 clauses, saving your compliance team the translation work.

Consistent policies, organisation-wide

Ensure terminology, roles, responsibilities and control requirements remain aligned across your entire policy suite, reducing confusion and improving implementation.

How the Review Aligns to DORA, NIS2, FCA Expectations
and the NCSC CAF?

Modern regulation doesn't just require you to have policies. It specifies what they must contain, who must approve them, how often they must be reviewed, and whether they're actually followed. The review benchmarks your suite against the four frameworks that matter most to UK and EU organisations:

DORA (EU Digital Operational Resilience Act)

DORA, applicable since 17 January 2025 to financial entities operating in the EU and relevant to UK firms with EU operations, group entities or EU financial-entity customers, is the most prescriptive framework ever written for ICT policy content. Its supporting technical standard on ICT risk management (RTS (EU) 2024/1532) sets explicit requirements for what ICT security policies must include: the date of formal approval by the management body, defined review cycles, recorded exceptions, specified consequences of non-compliance, lists of documentation to be maintained, segregation of duties, and detailed content requirements for identity, access, logging, patching, backup and asset management policies.

Our review checks your documents against these requirements article by article. Every relevant finding cites the specific article, so your DORA evidence pack effectively writes itself. For UK-only firms, we apply DORA as a benchmark baseline: the most demanding common denominator, so a suite that stands up to DORA stands up to almost anything.

NIS2 and the UK Cyber Security and Resilience Bill

The EU's NIS2 Directive requires in-scope essential and important entities to adopt cyber risk-management measures that expressly include policies on risk analysis, information system security, cryptography, access control, supply chain security and more. Management bodies are personally accountable for approving and overseeing them.

In the UK, the Cyber Security and Resilience Bill (introduced to Parliament in November 2025) modernises the NIS Regulations 2018 along similar lines, extends scope to managed service providers, data centres and designated critical suppliers, and places the NCSC's Cyber Assessment Framework on a firmer statutory footing.

If your organisation is in scope of either regime, or supplies to someone who is, your policy suite is the first artefact a regulator will ask for. The review benchmarks it against these expectations before they do.

FCA operational resilience and Handbook expectations

For FCA-regulated firms, policies are woven through the regulatory fabric: SYSC systems-and-controls requirements, the operational resilience regime (PS21/3 / SYSC 15A and PRA SS1/21) with its living self-assessment, record-keeping rules, SM&CR personal accountability, and — from 18 March 2027 — the new operational incident and third-party reporting regime (PS26/2), which your incident and supplier policies will need to reflect.

Our review flags where each policy supports these expectations, where it silently contradicts them, and where wording that reads as optional ("should") would fail the test of a rule that means "must".

NCSC Cyber Assessment Framework (CAF)

The CAF, now at version 4.0, is the UK's outcomes-based framework for cyber resilience, structured around four objectives, fourteen principles and forty-one contributing outcomes, and increasingly the benchmark UK regulators use across essential services, government (via GovAssure) and, under the incoming Bill, a widening set of sectors.

Policies sit at its heart: Objective A covers governance and risk management (are policies owned, approved and communicated?), and Principle B1 is literally "Service Protection Policies, Processes and Procedures" — asking not whether policies exist, but whether they're proportionate, communicated and demonstrably followed. Our review maps findings to the relevant CAF outcomes and — because the CAF is outcome-based — flags where a policy's wording would make an outcome hard to evidence as "achieved".

The Standing Benchmarks

ISO/IEC 27001:2022 (clause 5.2 policy requirements and Annex A controls), current NCSC guidance (which the review applies as living guidance, e.g. modern password policy positions on complexity, expiry and passphrases), Cyber Essentials/Cyber Essentials Plus, and UK GDPR/Data Protection Act 2018 where policies touch personal data.

(Note: The review provides independent assurance and regulatory relevance mapping. It is not a legal opinion, a compliance certification or a formal audit; confirming a formal compliance position may require dedicated legal or regulatory advice.)

What You Receive from our Security Policy Assurance Review

A per-policy review sheet

with every finding traceable to an exact document location.

Standard and regulation mapping

with findings referenced to the specific regulations that are relevant to your organisation for example the DORA/RTS article, NCSC guidance or FCA rule they relate to, where applicable.

Priority-rated findings

High/Medium/Low so remediation can be sequenced sensibly.

Practical remediation for every gap

Specific, actionable wording-level fixes, not generic advice.

Strengths, formally credited

A fair, balanced picture that recognises what's already working and protects team morale.

Policy-level consistency findings

Cross-policy contradictions, broken cross-references and inconsistent governance routes that no single-document review can catch.

A summary dashboard

Findings counts by policy and priority, updating automatically as your team closes items.

A living client-status tracker

Open/WIP/Closed/N/A per finding, yours to own as your remediation record.

Follow-up assurance review

A re-review of remediated policies to confirm findings have been addressed and provide evidence of progress for governance, audit and regulatory purposes.