
Explore why organizations need clear policies and procedures to establish rules, governance, and cybersecurity considerations. Learn how this course is organized, who it helps, and how to use the handouts.
Explore the five components of policy work—internal rules, mission, external rules, and external guidance—aligned via three platforms to connect for compliance and a fourth for mission and practices.
Explore external rules—laws, regulations, and other legal requirements—that organizations must assess and comply with, linking traditional law to cyber law, negligence, contract, data disposal, breach notification, and privacy.
Practice and action reveal what organizations actually do; align daily actions with mission, external rules, and internal policies, and turn good practices into written rules to guide behavior.
Develop mission-aligned governance documents and a compliant, clear tone culture by planning, writing, training, and updating policies with versioning and modular structure.
Learn planning on the fly when time is scarce, using triage to identify must-dos and avoid harm to the organization, with quick-start guidance and do-no-harm principles.
Analyze threats, harms, probability, and frequency to assess risk and guide policy decisions. Apply a framework—mission, internal and external rules, practices, and guidance—to manage risk via mitigation, transfer, or acceptance.
Develop clear governance and policy documents by practicing structured writing, outlining, active voice, and audience-aware word choice; apply layered writing, revision cycles, and cross-referencing to ensure clarity and efficiency.
Ensure effective version control of approved and draft documents through clear file naming, built-in revision histories, and structured review cycles. A dedicated document manager coordinates feedback to keep everyone aligned.
Gain early consensus on the document, socialize it with approvers, and submit an unapproved draft for final approval. Finalize by addressing changes, saving as approved versions, and distributing for publication.
Publish and distribute the policy through a central repository, notify employees with a summary of changes, and provide training with acknowledgements to ensure awareness, compliance, and implementation.
Explore cybersecurity frameworks as external, voluntary guidance that standardizes best practices for organizations. Learn NIST framework basics, key frameworks, and the four pillars of cybersecurity for governance.
Keep your new policies living by using them, reviewing annually, and updating as needed to stay current and aligned with external rules, mission, and culture.
Review the conclusion and resources, including the policy checklist, quick start guide, and references, to implement solid governance documents and a process that improves your organization.
Organizations need governance documents; those policies, procedures, and other written rules that tell the organization and employees what to do and how to do it.
These documents are an important part of management to help the organization comply with legal requirements, accomplish its mission, and run efficiently.
Policies have legal significance and are the first things requested by a government regulator or civil plaintiff—they could be Exhibit 1 in a lawsuit. Or they could be quality documents that keep your organization’s practices in compliance and avoid a lawsuit in the first place.
This course helps you and your organization build effective and quality governance documents. It aligns with my 2024 book and provides the highlights from it.
Policies are about both the destination and the journey. With a solid process you can improve your organization and the individuals on your project team while you create or update your documents.
This is for any type of organization and can be applied to any topic and any type of governance document. Learn about the Five Components for Policy Work and how to apply them for your company, non-profit, or government entity.
Some portions are specific to cybersecurity, an essential area and you will learn about the Four Pillars of Cybersecurity.
The course is divided into sections (which track the book parts):
Section 1 lays foundation of policy principles, including Bandler’s Five Components for Policy Work to ensure your governance documents consider organization mission, laws, best practices, existing governance documents and practices.
Section 2 provides important document project basics, including planning, people, and project management.
Section 3 gets into the details of managing the document project and writing. We analyze our components and what applies, write and edit the document, manage the project team, gain approval, finalize, publish, train and implement.
Section 4 is specific to cybersecurity policies and discusses laws, cybersecurity frameworks, and Bandler’s Four Pillars of Cybersecurity.
Section 5 is a brief overview about using, maintaining, reviewing and updating the documents to keep them current.
Section 6 tracks the Appendix, walking you through those parts that can be covered in an online course.
In sum, good policy work is an essential part of management and helps the organization comply and achieve the mission efficiently. Use this book to learn solid concepts and apply them in your organization.
This course is not for everyone! It is academic type lectures, using my PowerPoint slides, no fancy graphics, no fancy video editing. It is not entertainment. You will need a ten minute attention span (sometimes twenty). Consider your personal preferences, and see a few sample videos before you decide if this is right for you. If you have a problem or need something, message me. If you try it and its not right for you, no problem, Udemy has a great refund policy.
This course will not provide you with custom policies and procedures magically tailored to your organization.
It helps you with the process so you can do it yourself according to solid principles. Policy work is about both the journey and the destination.
My 2024 book is: Policies and Procedures for Your Organization: Build solid governance documents on any topic ... including cybersecurity. This course provides the highlights of it, but obviously does not cover every detail in the book.
Building these courses is a hobby for me, I do not have significant video recording skills, nor hardly any video editing skills, and there is no production team. It's slide and lectures. This course has almost no editing, so you will hear my pauses and misspeaks, warts and all.