Policy and governance
Proof that your management system operates, not just exists.
Policy register
Author policies in place or start from a template. Each carries an owner, a review cycle and a version history, and approval is separate from authoring so nobody signs off their own document. Policies link to the controls they satisfy.
Key capabilities
- Version history with a documented source for each version
- Review cycles, reminders and overdue surfacing
- Approval held separately from authoring
- Policy exceptions with their own approval and expiry
- Templates published centrally and adopted per organisation
Acknowledgement campaigns
Share a policy for acknowledgement, invite the people it applies to, and chase the ones who have not signed. Coverage is reported as a percentage of the population, so "who has not read it" is answerable. This is the evidence an auditor asks for when a control says staff are aware of the policy.
Key capabilities
- Invitation and automated chase sweeps
- Coverage by department and population
- Per-person acknowledgement record with date
- Exportable as audit evidence
Management reviews
Agenda, inputs, attendance, decisions and actions, with inputs drawn from the live registers so the minutes reference the same figures the auditor will see. Clause mapping shows which requirement each agenda item discharges.
Key capabilities
- Inputs pulled from the live registers
- Clause mapping to the framework requirement
- Decisions and actions tracked to closure
- Formal approval of the review record
Delegation, approvals and sign-off
Delegate a responsibility for a period, route approvals to the right person, and record formal sign-off where a framework requires a named individual. A segregation-of-duties check makes sure the roles a person holds do not defeat a control.
Key capabilities
- Time-bounded delegation
- Approval routing across modules
- Formal sign-off records
- Segregation-of-duties conflict checks
Proof point
Coverage is reported as a share of the people a policy applies to, not a count of signatures, so "who has not read it" always has an answer.
Questions about this
Why do downloaded policy templates fail audits?
Auditors interview staff and compare what they do with what the document says. Templates describe an organisation you are not.
How is policy acknowledgement evidenced?
Assignment campaigns record who read and accepted each policy and when, producing the evidence automatically.
How often should policies be reviewed?
Annually, with the review recorded, and on any change to the process the policy describes.
Which policies does a first SOC 2 or ISO 27001 need?
Information security, acceptable use, access control, change management, incident response, business continuity, vendor management, data classification and retention, plus role-specific ones your scope requires.
Keep reading
Article
How to write security policies people follow
Read the article →
Guide
SOC 2 compliance guide
Read the guide →
Product
Personnel and access
See the module →