Skip to main content

Governance Policy Development

A structured policy development engagement aligning security expectations with business objectives and recognized frameworks.

Organization
Cybersecurity Internship Portfolio
Duration
4 weeks
Project Type
Governance
ISO 27001NIST CSFCIS Controls

Objective

Develop, review, and align cybersecurity policies and standards with organizational requirements, compliance obligations, and industry best practices.

ISO 27001NIST CSFCIS Controls

Step-by-Step Execution

  1. Step 1

    Baseline Policy Research

    • Studied ISO/IEC 27001 Annex A, CIS Controls v8.1, and NIST Cybersecurity Framework (CSF) 2.0.
    • Identified the minimum policy set required for organizations, including access control, incident response, password management, and vendor risk management.
    • Researched industry-specific compliance requirements including HIPAA for healthcare and PCI DSS for payment systems.

  2. Step 2

    Policy Inventory

    • Collected existing cybersecurity policies from ADDI and Diaspocare.
    • Created a policy inventory documenting policy title, owner, last review or update date, and purpose.

  3. Step 3

    Gap Analysis

    • Compared existing documentation against baseline requirements.
    • Identified missing policies, outdated policies, and redundant policies suitable for consolidation.
    • Examples included no Mobile Device Policy for Diaspocare and an ADDI Information Security Policy last updated in 2020.

  4. Step 4

    Drafting & Updating Policies

    • Drafted new policies using Eretmis Academy templates.
    • Updated existing documents to include multi-factor authentication, vendor onboarding requirements, and current compliance expectations.
    • Ensured alignment with applicable standards.

  5. Step 5

    Internal Review & Peer Feedback

    • Conducted peer review sessions with fellow interns, Eretmis mentors, and organizational stakeholders.
    • Improved documents through iterative revisions.

  6. Step 6

    Finalization & Delivery

    • Produced a Policy Governance Library for each organization.
    • Grouped policies into general baseline policies and compliance-specific policies.
    • Delivered a Policy Gap Analysis Report with findings, identified gaps, and recommended remediation steps.

Deliverables

Governance

Policy Governance Library

Complete policy library for each organization, grouped into general baseline policies and compliance-specific policies.

Gives teams a consistent reference point for cybersecurity governance and policy accountability.

Gap Analysis

Policy Gap Analysis Report

Report containing findings, identified documentation gaps, and recommended remediation steps.

Turns policy review work into practical next steps for governance improvement.

Skills & Insights Gained

Policy Lifecycle ManagementCompliance Awareness (HIPAA, PCI DSS, GDPR)Critical Thinking & Gap AnalysisTechnical Policy WritingCollaboration & Peer ReviewGovernance mindset and organizational accountability

Continue exploring

Internal Audit

Internal Cybersecurity Audit

An internal assessment that reviewed security controls, documented gaps, and produced a prioritized remediation roadmap.

NIST CSFCIS ControlsISO 27001
View case study

Risk Management

Enterprise Risk Assessment

A risk assessment project documenting assets, threats, likelihood, impact, and treatment options for management review.

CIS RAMNIST CSFISO 27001
View case study

Vendor Risk

Third-Party Risk Assessment

A vendor review workflow covering due diligence, control questions, risk scoring, and onboarding recommendations.

NIST CSFISO 27001CIS Controls
View case study