Get a quote
8 Policy & Process — Pillar 2

Your security policies are the foundation your business builds compliance on.

786 Cyber generates production-ready, organisation-specific policies and maps your controls across every compliance framework — automatically. From first policy to audit-ready in minutes, not months.

Start free — no credit card needed Speak to an expert
Applies to: All UK & EU businesses  ·  businesses without a security team  ·  MSPs managing client compliance

Why policies matter

A security policy isn't a document you file away. It's how your business proves it operates responsibly.

Most organisations understand they need security policies. Fewer understand what those policies actually unlock — commercially, operationally, and legally. The cost of not having them is significant. The value of having them properly documented and maintained is even greater.

What undocumented policies cost you
Failed audits: The most common reason organisations fail compliance audits isn't that they lack security controls — it's that they can't evidence them. An undocumented control is an absent control in the eyes of an auditor.
Lost commercial opportunities: Enterprise procurement teams and public sector buyers require written policies before supplier onboarding. Without them, the conversation ends before it begins — regardless of how secure your systems actually are.
Insurance claim rejections: Cyber insurers are increasingly denying claims where no documented security policies were in place. A policy you can't produce is a policy that didn't exist.
Regulatory exposure: GDPR, NIS2, and DORA all require specific written documentation. The absence of an Incident Response Policy or Data Protection Policy is itself a regulatory breach — separate from any incident that may occur.
Inconsistent staff behaviour: Without clear written policies, staff make judgement calls under pressure. One inconsistent decision — how a lost device is handled, how a client file is shared — can cascade into a breach, a fine, or a contract dispute.
What well-documented policies unlock
Procurement credibility: Walk into any enterprise supplier assessment with a complete policy suite and you immediately signal maturity. Documented policies turn a conversation about whether you're secure into a conversation about how you work together.
Faster due diligence: Investment, acquisition, and partnership due diligence all include security reviews. A versioned, documented compliance programme removes a major risk item and accelerates the process significantly.
Lower insurance premiums: Insurers price risk based on evidence. Documented controls and reviewed policies are proof of a security culture — and they're reflected in the premium you're quoted.
Operational clarity at scale: Policies are institutional memory. They scale your security culture without adding headcount — new staff know the rules from day one, contractors understand their obligations, and the business grows without introducing new risk at every hire.
Incident recovery speed: When something goes wrong, documented incident response processes mean your team acts decisively and consistently. The evidence vault means you can demonstrate what was in place — which matters for regulators, insurers, and clients.

"The question isn't whether your business takes security seriously. It's whether you can prove it — to a client, an auditor, an insurer, or an investor — in under five minutes."

Policies aren't compliance admin. They're business infrastructure.

Every scaling business reaches a point where informal practices become liabilities. A team of five runs on shared understanding. A team of fifty needs documented processes — not because a regulator demands it, but because the business can't function consistently without them.

The moment you document how your organisation handles data, responds to incidents, manages access, or onboards staff, you stop relying on individual judgement under pressure. You create accountability, reduce error, and build a culture where security is a reflex — not an afterthought.

786 Cyber generates these policies in minutes, tailored to your organisation's specific context, and keeps them current as your business and regulatory landscape evolve — without manual overhead.

During procurement

Enterprise clients and public sector buyers ask for your Acceptable Use, Data Protection, and Incident Response policies as part of supplier onboarding. With 786 Cyber, you generate and export audit-ready documents in minutes — not weeks of manual drafting.

During fundraising or acquisition

Security due diligence is now standard in investment and M&A. A documented policy suite, version history, and compliance audit trail removes a common deal risk and builds confidence at the negotiating table.

During an incident

A documented Incident Response Policy means your team acts immediately and consistently. The 786 Cyber compliance vault means you can demonstrate controls were in place — critical for GDPR breach notification, insurance claims, and client communication.

During growth

Every new hire is a security risk without documented expectations. A Password Policy, Remote Working Policy, and BYOD Policy mean new staff understand your rules from day one — reducing the human error risk that causes most breaches.

What you get

Two modules. Everything your compliance programme needs.

Policy & Process covers Modules 1 and 2 — the Compliance Engine and the Policy & Controls Vault. Both are live in the platform today.

1
Module 1

Compliance & Best Practices Engine

  • AI compliance wizard

    6-step assessment produces a prioritised, customised roadmap across all selected frameworks in minutes.

  • Framework recommendations

    AI recommends the right frameworks based on your industry, size, region, and existing certifications.

  • Progress tracking

    Visual progress rings per framework — showing % completion, controls implemented vs total required.

  • Compliance Vault

    All assessments, roadmaps, evidence, and renewal dates stored and version-controlled in one place.

Live Supports GDPR · Cyber Essentials · ISO 27001 · NIST CSF · NIS2 · DORA · PCI-DSS · HIPAA
2
Module 2

Policy Management & Controls Vault

  • AI policy generation

    15+ policy types auto-populated with your company name, industry context, and regulatory requirements.

  • Cross-framework tagging

    Every control and policy is tagged — one control satisfies multiple frameworks simultaneously.

  • Version history & audit trail

    Full change history on every policy — who changed what, when, and why. Essential for audit submissions and regulatory evidence.

  • PDF export

    Export any policy or compliance summary as a formatted PDF — ready for board reporting or regulatory submission.

Live Acceptable Use · Password · GDPR · Incident Response · Remote Working · BYOD · and more

How the tagging system connects everything

Every control, policy, and compliance requirement in 786 Cyber carries a set of tags. These tags are the intelligence layer that eliminates duplicate work — implement one control and automatically progress across multiple frameworks simultaneously.

Example — Multi-Factor Authentication control

domain:access-control control:mfa framework:cyber-essentials framework:iso27001 framework:gdpr policy:password policy:acceptable-use severity:critical

Implementing MFA satisfies requirements across Cyber Essentials, ISO 27001, and GDPR simultaneously — and links back to 2 policies and 3 framework requirements automatically.

Platform features

Built to make compliance achievable — and maintainable long term.

Getting compliant once is only part of the job. 786 Cyber keeps your policies current, your team aligned, and your evidence vault ready — automatically.

AI policy generation

Generate any of 15+ policy types in minutes, pre-populated with your organisation's industry, size, and regulatory context. No templates to fill in manually.

Audit trail & version history

Every policy change is logged automatically — who made it, when, and what changed. When an auditor or insurer asks for evidence, it's already there.

Role-based access control

Admin, Security Lead, and Viewer roles let you assign the right level of access to each team member. Sensitive compliance documents are protected by default.

Risk score & compliance rings

A live overall risk score and per-framework progress rings show your compliance posture at a glance — and update in real time as controls are implemented.

Monthly security summaries

Automated monthly reports delivered to your inbox — policies created, controls implemented, risk score movement, and recommended next steps for the month ahead.

Multi-org & MSP portal

Manage multiple organisations from one account. MSPs get a dedicated multi-tenant dashboard — generate client-branded compliance reports across every client simultaneously.

Sample extract

See what 786 Cyber actually produces.

This is a real extract from a compliance roadmap generated for a fictional UK professional services firm — Meridian Consulting Ltd, 47 employees. It shows exactly what your team, or your MSP clients, would see after running the Compliance Wizard.

Want a personalised sample for your industry?

Speak to our team — we'll run the wizard live and show you your actual roadmap. Book a call →

Frameworks in this extract:

Cyber Essentials UK GDPR ISO 27001 NIST CSF

View as:

Compliance Roadmap Extract
Meridian Consulting Ltd
Professional services · 47 employees · London, UK
58
Risk score
3
Frameworks
12
Actions

Framework progress

Cyber Essentials40%
UK GDPR55%
ISO 2700118%

Priority controls

!
Implement multi-factor authentication (MFA)
Required for all admin accounts. Closes critical access control gap.
domain:access-control control:mfa framework:cyber-essentials framework:iso27001 framework:gdpr severity:critical
~
Complete Data Protection Policy
Draft exists — needs review, approval, and staff acknowledgement.
policy:data-protection framework:gdpr framework:iso27001 domain:data-protection severity:high
○
Configure boundary firewall and patch within 14 days
Mandatory for Cyber Essentials certification. Currently unverified.
domain:network control:firewall control:patching framework:cyber-essentials severity:high
Acceptable Use Policy — published v1.2
All 47 staff acknowledged. Last reviewed 14 Mar 2026.
policy:acceptable-use framework:cyber-essentials framework:iso27001 domain:governance
Generated by 786 Cyber · 1 May 2026 Page 1 of 6

Sample extract only. Sign up free to generate your organisation's real roadmap.

Framework coverage

Policy & Process underpins every major compliance framework.

Start here and you're building the foundation for all of them.

UK · Mandatory

Cyber Essentials

Policies cover 3 of the 5 CE control categories. Required for UK government suppliers.
UK & EU · Legal

UK & EU GDPR

Data Protection Policy, Privacy Notice, and DPIA process — required under Article 32 for both regimes.
International

ISO 27001

ISMS policy suite and all 93 Annex A controls — 786 Cyber maps and generates them all.
US / International

NIST CSF

Protect and Identify functions are heavily policy-driven. 786 Cyber covers both.
EU · Mandatory

NIS2

Incident response, business continuity, and supply chain policies — all NIS2 requirements.
EU · Financial

DORA

ICT risk management framework and policy documentation mandatory from January 2025.
Payment

PCI-DSS

Written security policies are requirements 12.1–12.4 — non-negotiable for card processing.
UK · Enhanced

Cyber Essentials Plus

All CE policies must be in place before the independent technical audit begins.

Quick checklist

The 10 policies every UK business needs.

786 Cyber generates all of these automatically — version-controlled, tagged to your frameworks, and exportable as PDF.

  • !
    Acceptable Use Policy — governs how staff use company systems, devices, and internet access. Required for Cyber Essentials.
    framework:cyber-essentialsframework:iso27001policy:acceptable-use
  • !
    Data Protection Policy — documents how personal data is collected, stored, and processed. Required by UK & EU GDPR Article 32.
    framework:gdprframework:uk-gdprframework:iso27001policy:data-protection
  • !
    Incident Response Policy — defines how your organisation detects, responds to, and reports security incidents. Mandatory for GDPR 72hr notification, NIS2, and ISO 27001.
    framework:gdprframework:nis2framework:iso27001policy:incident-response
  • ~
    Password Policy — sets minimum standards for password complexity, rotation, and MFA requirements.
    framework:cyber-essentialsframework:iso27001policy:passwordcontrol:mfa
  • ~
    Remote Working Policy — governs secure access, device usage, and data handling outside the office.
    framework:cyber-essentialsframework:gdprpolicy:remote-working
  • ~
    BYOD Policy — covers personal devices used for work. Required if staff access company systems on personal phones or laptops.
    framework:cyber-essentialspolicy:byoddomain:endpoint
  • ~
    Third Party Risk Policy — governs how you assess and manage supplier and vendor security. Required for ISO 27001, NIS2, and DORA.
    framework:iso27001framework:nis2framework:dorapolicy:third-party-risk
  • Business Continuity Policy — defines how the organisation maintains operations during and after a disruption.
    framework:iso27001framework:nis2policy:business-continuity
  • Change Management Policy — controls how changes to systems, software, and processes are assessed, approved, and recorded.
    framework:iso27001framework:pci-dsspolicy:change-management
  • Information Security Policy — the top-level policy establishing your ISMS scope and management commitment. Required by ISO 27001 Annex A.5.
    framework:iso27001framework:nist-csfpolicy:information-securitydomain:governance
Legend: ! Critical — all businesses ~ Important — most businesses Good practice — growing businesses

Ready to get your policies in order?

Generate your first policy in minutes. No security expertise needed. 786 Cyber does the heavy lifting — you stay in control.

Start free — no credit card Speak to an expert Browse compliance frameworks →

For MSPs: enquire about the partner programme →

Controls Library

One control, many frameworks

The 786 Cyber controls library maps your implemented security controls against multiple frameworks simultaneously. Add a control once — see it scored across Cyber Essentials, ISO 27001, SAMA CSF, and more.

Explore compliance frameworks →

Policy Vault

Every policy, versioned and audit-ready

Generate, store, and version-control all your security policies in one place. Each policy is AI-validated against your selected framework, exported as a branded PDF, and tracked through approval workflows.

Get a quote →