Most organisations already have a security plan. Very few have one that actually gets used. After reviewing dozens of plans across corporate and public-sector clients, we’ve found the same failure points again and again — and none of them are about the writing.
The plan was written for an audit, not a team
Plans commissioned to satisfy a compliance requirement tend to read like compliance documents: comprehensive, defensible, and almost unusable day-to-day. If the people expected to follow a procedure can’t find it, understand it, or fit it into their actual workflow, it will quietly stop being followed within a few months — regardless of how thorough it was on paper.
Ownership was never assigned
Every control in a plan needs a name attached to it — not a department. When responsibility is diffuse, maintenance drifts: access lists go stale, post orders fall out of date, and nobody notices until an incident forces the question. We build a named owner into every section we write.
Nobody revisits it after go-live
A plan is a snapshot of a moment — the building, the staff, the threat picture at the time it was written. Environments change faster than most plans get reviewed. We recommend a fixed review cadence (annually at minimum, or after any material change to the site or operation) so the document stays a working tool rather than an artifact.
What we do differently
Every plan we deliver is scoped to what a team can realistically sustain, assigns clear ownership at the section level, and includes a built-in review schedule. It’s a smaller document than most consultancies produce — deliberately. Shorter plans get read. Read plans get followed.
