Synthetic IndustryGet a price

Case study · Security and compliance

A customer asked for the company's security policies. We wrote them from what the company really does.

A customer's security review asked for written policies. We wrote six short ones, and every sentence traces to something the company confirmed is true.

Who
A software startup with about thirty staff, preparing for a customer's security review.
The problem
A customer asked for written security policies. The company had none of its own, only downloaded templates that described things it did not do.
What we did
Had the company answer a plain fact sheet about what it really does, then drafted six short policies using only those confirmed answers.
The result
Six short policies where every sentence is tied to a confirmed fact, plus a dated list of the things the company wants to do but does not yet.
Time
One week.
Get a price for something like thisThe service behind it

What was going on.

A customer's security review asked the startup for its written security policies. The company had none of its own. Someone had downloaded a set of templates and was ready to put the company's name on it.

The templates said things like every laptop is encrypted and every leaver loses access on their last day. That was not quite true of this company. A policy that overstates what you do is worse than none: the moment a customer relies on it, it becomes a false statement.

What we found.

The fix was to start from facts, not from a template. We gave the company a fact sheet of about forty plain questions about what it does today: access, backups, devices, incidents, suppliers and staff leaving. The owner answered each one honestly, including marking what was not yet done.

Then every sentence in every policy was drafted from one confirmed answer and tagged with it. Anything the company did not yet do was left out of the policies and put on a goals list as a dated goal with an owner, never written as a fact.

The technical detail

Up to six short policies were drafted from the fact sheet. A script checks that every sentence links to a fact-sheet answer and that no answer marked as not done appears as a statement of practice. A second check looks for any sentence that claims a certification, legal compliance or a control the fact sheet does not support.

What we did.

How the work ranSteps in order: 1 Agree the policies: Which ones, for whom, and who confirms; 2 Answer the fact sheet: About forty plain questions, honest answers; 3 Draft from the answers: Each sentence tied to one answer; 4 Keep goals separate: A dated goals list, never a policy; 5 Check every sentence: No sentence without a fact behind it; 6 You confirm and sign: The owner confirms each is true today. You decide at step 1 and step 6.1 Agree the policiesWhich ones, for whom,and who confirms2 Answer the factsheetAbout forty plainquestions, honestanswers3 Draft from theanswersEach sentence tied toone answer4 Keep goalsseparateA dated goals list, nevera policy5 Check everysentenceNo sentence without afact behind it6 You confirm andsignThe owner confirmseach is true todayYou decide here How the work ranSteps in order: 1 Agree the policies: Which ones, for whom, and who confirms; 2 Answer the fact sheet: About forty plain questions, honest answers; 3 Draft from the answers: Each sentence tied to one answer; 4 Keep goals separate: A dated goals list, never a policy; 5 Check every sentence: No sentence without a fact behind it; 6 You confirm and sign: The owner confirms each is true today. You decide at step 1 and step 6.1 Agree the policiesWhich ones, for whom, and who confirms2 Answer the fact sheetAbout forty plain questions, honest answers3 Draft from the answersEach sentence tied to one answer4 Keep goals separateA dated goals list, never a policy5 Check every sentenceNo sentence without a fact behind it6 You confirm and signThe owner confirms each is true todayYou decide here
The steps in order. A box with a coloured border is where the client decided.

How we checked it.

These had to pass before we asked for sign-off.

  • Every sentence in every policy points to a fact-sheet answer the owner gave, and the owner confirmed in writing that each is true today.
  • None of the answers marked as not done appears in a policy as a statement of practice.
  • A checker found no sentence claiming a certification, legal compliance or a control missing from the fact sheet.

What they have now.

The company received its policies with every sentence linked to its fact, the filled-in fact sheet, a goals list showing each thing it wants to do with an owner and a date, and a list of statements the owner had marked as not true. A director signed them.

The company could send its customer a set of policies it could stand behind, and a short honest list of what it was still working towards.

What we did not do.

  • We did not invent controls or write a policy for something the company does not do.
  • We gave no legal advice and made no statement that the policies satisfy a law, a framework or a contract.
  • We promised no certification and no audit result. The customer or auditor decides that.
  • We did not check that the company's systems match its answers. That is a separate service.
  • We did not train staff or roll the policies out.

The service behind this.

A policy helps only when every sentence matches what the company does. Starting from the facts is how you get there.

One-off job

Policies drafted from real practice

Up to 6 short policies, such as access and backup, written from a fact sheet your owner fills in. Every sentence is confirmed as true today; what you do not do becomes a goal, not a claim.

$385. $385 after the agreed test passes and you sign off. No payment before sign-off.

Get a priceSee what is included

More case studies.

All case studies

Get a price for something like this

You are asking about: Policies drafted from real practice.

Add detail (optional)

A web address anyone can open, with no login in it. No code or logs.

We reply by email. Sending this emails your request to our team; nothing is kept in a website database. Please do not send passwords, keys or customer records. Privacy notice.

Sending this is not an order. We check we can help, then agree what is included, safe access and the price in writing before any work. Prefer email? hello@syntheticindustry.ai.