Security Improvement - Organization
Protocols & Procedures
Cocoon develops and updates security protocols and procedures based on risks and practical experience, rather than a compliance checklist.
- Workable agreements, from overarching policy to concrete work instructions
- Based on practical experience from physical audits, mystery visits, and red teaming assignments
- Focused on practical compliance, not on more rules on paper
Protocols & Procedures at Cocoon
Good security begins with clear agreements. However, in practice, protocols and procedures are often too general, outdated, or written from a compliance perspective rather than daily operations. Cocoon develops and updates security protocols and procedures based on both risks and practical experience from physical audits, mystery visits, and red teaming assignments—ranging from overarching policy to concrete work instructions for areas such as visitor registration, incident reporting, and access management.
Cocoon begins with an inventory of existing protocols and workplace practices: do the agreements on paper align with what employees actually do? Subsequently, protocols are rewritten or drafted based on risks and concrete work situations, using clear language that resonates with the target group’s daily routine. Where possible, findings from previous Cocoon services—such as a physical penetration test, Mystery Visit, or Red Teaming assignment—are directly incorporated, ensuring the protocol is not only theoretically sound but also demonstrably addresses what goes wrong in practice.
The goal is not more rules, but work agreements that are actually executed. Practical and actionable protocols lead to higher compliance, fewer differences in interpretation, uniform working methods, and better incident handling. Blind spots are replaced by work processes that demonstrably function and provide a strong foundation for audits, training, and awareness.
Who is this service intended for?
This service is intended for organizations looking to professionalize their security policy, working toward BIO, ISO 27001, or NIS2, the Wwke (CER Directive), or those wishing to implement uniform working methods across multiple locations with high visitor volumes or increased security requirements.
Protocols & Procedures is often deployed following a physical penetration test or audit that revealed existing agreements do not align with practice, in preparation for an upcoming ISO or NIS2 audit, or when multiple locations are still operating with different, non-uniform methods.
Why choose Cocoon
Cocoon does not write protocols based on a compliance checklist, but rather on risks and practical experience from its own physical audits, mystery visits, and red teaming assignments. This means a protocol is not only correct on paper but also aligns with what actually happens in practice, ensuring it is truly applied during a retest.
A protocol that no one follows is not a protocol. It is a risk with a stamp on it.
Protocols & Procedures combines well with Compliance Support to translate workable agreements into demonstrable compliance for auditors and regulators.
- Written based on risk and practical experience, not a compliance checklist
- Findings from previous Cocoon services directly incorporated into the protocol
- From overarching policy to concrete, actionable work instructions
Practical Example: From Paper Protocol to Working Process
A logistics organization had an extensive visitor protocol that contained so many ambiguities it was hardly used. Cocoon translated this into a practical work process; during a retest, visitors were correctly searched, registered, and escorted. Similarly, a manufacturing company improved its supplier procedure, ensuring that all visitors were henceforth checked and registered.
Frequently asked questions
What are the costs for drafting or updating protocols?
The costs depend on the number of protocols, the size of the organization, and whether multiple locations are involved. You will receive a customized quote following a brief intake.
How long does a project take?
That depends on the number of protocols and whether an assessment of the current situation is required first. During the intake, we will establish a realistic schedule together.
Do you work from a fixed template?
No. Protocols are developed based on your organization’s specific risks and practices, not from a generic, one-size-fits-all template.
What is the Difference Between Protocols & Procedures and Compliance Support?
Protocols & Procedures focuses on establishing practical agreements. Compliance Support goes a step further: this service helps you demonstrate to auditors and regulators that these agreements are indeed adhered to.
Who is this service for?
For organizations seeking to professionalize their security policy, working toward BIO, ISO 27001, or NIS2 compliance, the Wwke, or those wishing to implement uniform procedures across multiple locations.
Can findings from a previous test be included?
Yes, and this is recommended. Findings from a physical penetration test, Mystery Visit, or Red Teaming engagement are directly incorporated into the protocol where relevant, ensuring it aligns with what actually goes wrong in practice.