First Hand Experience We have been working with Dave Lineman for many years. We went from having no formal IT policies to a robust Written Information Security Program (WISP). Dave was also instrumental in helping us with some of our most difficult IT compliance reviews.

Information Shield has helped my… Information Shield has helped my business to become compliant with various information security requirements imposed by our clients.

Perfect Product for Small Companies and… Perfect Product for Small Companies and StartUps with minimal budget.

Could Use Some Work I liked the policy coverage and organization of topics. I didn't like the number of typos, grammar mistakes and inconstancies between the documents. This project really needs a good editor to make it more useful. Otherwise your customers need to read everything very carefully and correct all your mistakes before using the policies. Some of the content needs an update to include modern technologies (more about 2FA and MFA - including biometrics like finger scans and facial recognition), less about fax machines, PDAs and printer ribbons). The organizational roles are named inconsistently throughout. Discussions of the same topic (e.g., shredding of paper documents) are described differently in different policies. The Information Classification Policy, which in many ways is a core element of this system, needs some more thought and is inconsistent. For example, the four categories listed include one called "UNCLASSIFIED"; however, the descriptions in the following paragraphs refer to "PUBLIC" instead. In which category is PII included? The Information Security Program Policy document says policy documents should be classified as "CONFIDENTIAL - Internal Use Only" but that's not one of the categories and the Information Classification Policy states they should be classified as "PRIVATE". Which is correct? I suggest adding a Roles and Responsibilities section to each policy. This system seems like it was designed for large organizations (based on the number of roles and internal groups described). Please consider adding advice for adapting this system to a smaller organization (e.g., with 10 or fewer staff). Small organizations are expected by their clients to have the same policy coverage as large organizations.