Most policy sets were written for an office everybody worked in, on devices the company owned, before the PDPA amendments. We review what you have, identify what is missing, contradictory or unenforceable, and hand back a set of documents your organisation can actually adopt and apply.
A cybersecurity policy review is an independent assessment of the documents that define how your organisation expects information and technology to be handled. We read what you have, compare it against your actual operating reality and against recognised standards, and identify three categories of problem: gaps where no policy exists, contradictions where two documents say different things, and clauses that could not be enforced if they were ever tested.
The review covers the core set: acceptable use, password and authentication, remote and hybrid working, bring your own device, incident response, data classification and handling, access control, third-party and vendor management, email and communications, and clean desk and physical security. We assess each for coverage, currency, internal consistency, enforceability under Malaysian employment practice, and alignment with your obligations under the PDPA.
Crucially, the output is a redrafted policy set rather than a critique. A report telling you that your BYOD policy is inadequate is of limited use to an organisation with nobody available to write a better one. We hand back documents drafted for your organisation, ready for legal review and adoption.
Policy is where enforceability comes from. When a member of staff copies a customer database to a personal drive, the disciplinary position depends entirely on whether a policy prohibited it, whether the employee acknowledged that policy, and whether it was applied consistently. Without that chain, the organisation is exposed both to the incident and to a claim arising from how it responded.
Working patterns have moved faster than documentation. Hybrid working, personal devices reaching corporate data, staff using consumer messaging apps for business, and generative AI tools receiving confidential information pasted into a prompt are all now routine. Most policy sets we review are silent on at least two of these, and silence is not a control.
The amended PDPA also raised the documentary bar. Mandatory breach notification, the duty to appoint a data protection officer for organisations meeting the prescribed thresholds, and the expectation of demonstrable security safeguards all assume a documented control environment. During an enquiry, the Commissioner will ask what your policies required. "Everyone knows not to do that" is not a defence, and a policy last reviewed in 2019 is only marginally better.
We assess your existing documents where they exist and draft from scratch where they do not. The set below is the standard scope, and it can be extended to sector-specific policies.
The foundation document. We check it covers current realities: personal device use, cloud storage, messaging apps, generative AI tools, personal email, social media and the boundary between acceptable personal use and misuse. We also check it is written plainly enough that staff can follow it.
Reviewed against current guidance rather than legacy habits. Forced ninety-day rotation and complex character rules demonstrably produce weaker passwords. We assess length requirements, password manager provision, multi-factor authentication coverage, service account handling and the credential reset process.
Covering home network expectations, public wifi, VPN use, physical security of devices away from the office, working from overseas and its data transfer implications, and the handling of confidential information in shared living spaces.
The hardest policy to get right in Malaysia, because it sits at the intersection of security and personal privacy. We address enrolment requirements, what the organisation can and cannot see on a personal device, remote wipe scope and consent, and what happens on the day an employee leaves.
Reviewed for the things that matter under pressure: clear definitions, a reporting route staff can actually use, defined escalation thresholds, named decision authority, and a documented process for assessing and meeting the personal data breach notification duty.
Across the whole set: what is missing, where documents contradict each other, where a policy references a system or a role that no longer exists, and where a requirement could not survive being challenged. Findings are prioritised by risk and by effort to fix.
A current, consistent, enforceable policy set is one of the cheapest controls available and one of the first things anyone assessing you will ask to see.
When an incident involves employee conduct, the organisation's position rests on documented, acknowledged, consistently applied policy. Getting that right in advance is considerably cheaper than discovering the gap during an industrial relations claim.
Enterprise clients, ISO 27001 auditors and cyber insurers all begin by asking for the policy set. A current, coherent set moves those conversations along quickly. A contradictory one invites a much deeper look.
Most policy violations are not defiance, they are people guessing. Clear guidance on whether a customer list may be emailed to a personal address, or whether client data may be pasted into an AI tool, removes the guessing.
Policies that explicitly reference the organisation's obligations, including breach notification and the responsibilities of the data protection officer, are direct evidence of a documented control environment during a Commissioner enquiry.
The absence of a BYOD policy is invisible until an employee leaves with company data on a personal phone. Reviews surface those gaps while they are still theoretical.
The review establishes ownership, a review frequency and an approval route for each policy, so the set does not silently drift back out of date over the following three years.
Four to six weeks depending on the size of the existing policy set and how many documents need drafting from scratch.
We collect everything: formal policies, standard operating procedures, the employee handbook, IT guidance notes and any relevant clauses in employment contracts. Policy obligations are often scattered across several documents, and knowing where they all sit is the first finding.
We talk to IT, HR and a sample of business users about how work actually happens. This is essential, because the most common finding is not a missing policy but a policy the organisation has quietly stopped following, which is worse than having none.
Each document is assessed for coverage, currency, internal consistency, enforceability and alignment with PDPA obligations and recognised standards. Findings are graded so you can distinguish a genuine control gap from a drafting improvement.
We redraft the deficient documents and write the missing ones, in plain language, sized to your organisation. A twenty-page acceptable use policy at a company of ninety people will not be read, so we do not write one.
We work through the drafts with your stakeholders, adjust for your culture and industrial relations position, and support the adoption process: management approval, employee communication, acknowledgement capture and record keeping.
We leave you with a policy register recording owner, approval date, review frequency and next review date for each document, so the set stays current. Where the review reveals staff do not understand what the policies require, awareness training closes that gap.
Everything is delivered in editable format and belongs to you. There is no licensing arrangement on documents that govern your own organisation.
Every document assessed, every gap identified, graded by risk and effort, with a clear statement of what is missing and what is unenforceable.
Acceptable use, password and authentication, remote work, BYOD, incident response and any additional policies in scope, drafted for your organisation in editable format.
A single register recording each policy, its owner, approval date, review frequency and next review date, ready to hand to whoever maintains governance documentation.
A mapping showing which policy addresses which obligation, covering PDPA duties and recognised control frameworks, which is what an auditor or an enterprise client will ask for.
A plain-language summary suitable for circulation, plus an acknowledgement form and record-keeping approach so you can evidence that staff received and accepted the policies.
A short report covering the current position, the material gaps, what has been remediated and what remains, suitable for tabling at management or audit committee.
Any organisation whose policy set predates hybrid working, personal device use or the PDPA amendments, which is most of them.
Regulated organisations need the alignment mapping most. Everyone else usually comes to us because a client or an insurer asked to see the policies.
Smaller organisations usually need documents drafted from scratch. Larger ones usually have too many documents saying inconsistent things, which is a different problem.
Policy touches every function, but these are the teams that own, apply or enforce the documents.
Anyone can supply a policy template. The difficulty is producing documents that fit your organisation, survive challenge and are short enough that people read them.
Policy is governance, and our review is structured to produce evidence: a register, an alignment mapping, an acknowledgement trail and a review cycle. That structure is what turns a set of documents into something an auditor or the Commissioner would accept as a control environment.
We draft to the size of the organisation. A ninety-person company gets a policy set it can realistically apply, not a framework designed for a multinational. Where a policy would be unenforceable in practice we say so and propose something that would actually work instead.
Our consultants have run compliance, data protection and security functions inside Malaysian organisations, not only advised on them from outside. That shows up in the advice: we know what a lean IT team can absorb in a quarter, and we know which recommendations get quietly shelved.
Scenarios use Malaysian references your staff will recognise, from DuitNow payment requests and e-invoice notices to LHDN and EPF correspondence. Reporting is framed against the obligations your regulators and auditors actually cite, including the 72-hour personal data breach notification duty introduced by the 2024 amendments to the PDPA.
Where the review shows that staff do not understand what is expected of them, awareness training can be delivered as an HRD Corp claimable programme for levy-contributing employers, subject to grant approval before delivery. Policy and understanding have to move together, since an unread policy protects nobody.
Tell us your headcount, your industry and what triggered the interest, whether that is an audit finding, a near miss, a board question or a regulator letter. We will come back with scope, timeline and a fixed quotation. No obligation, and we will say so if you do not need us yet.
