Core Fundamentals Set

Small organisations

What this set does

A 300-page ISMS is the wrong tool for a 25-person company. This set is deliberately short: one information security policy, eleven standards that cover the controls small organisations are actually asked about, and a one-page acknowledgement form. It maps to the five Cyber Essentials control themes and the most common questionnaire items.

What's inside

• Information security policy (single document)
• Standards: acceptable use, access control and MFA, passwords, device and mobile, patching, backup, email and phishing, remote working, supplier, data handling, incident reporting
• Cyber Essentials self-assessment mapping
• Common customer questionnaire answer bank
• Staff acknowledgement form

Who it is for

Organisations under roughly 100 people that need credible documentation this week, not a certification programme.

How the documents are structured

Every document opens with its purpose, scope and owner, then the substantive content, then a control cross-reference showing which framework requirements it satisfies. Standards state requirements in testable language ("must", with the parameter). Procedures follow one format: trigger, roles, steps, frequency, records produced. Placeholders are limited to things only you can know: organisation name (which we fill in), system names, role titles, tool names and timelines. There are no "[insert policy here]" sections.

Tailoring effort

Expect to spend a few hours on a policies-and-standards set and longer on procedures, because procedures describe how your team actually works. The document register in each set lists every file with a suggested owner so you can split the work.

Licence

One purchase covers one organisation for internal use, with unlimited users and unlimited edits. Consultancies and MSPs tailoring documents for clients need the multi-client licence; see the terms or ask us.