Policy Management
Controls mapped to the clause, not the document
A policy is written in sections mapped to the controls it mandates, then versioned, approved and acknowledged by the people it binds. Exceptions are requested, compensated, approved and renewed on the record.
- Section and bullet level control mapping
- Draft → review → published lifecycle with versions and approvals
- Acknowledgement campaigns that chase anyone who has not confirmed
- Expiry views for what falls due in 30, 60 and 90 days
In the application · Govern
- Policies
- Versions & approvals
- Acknowledgements
- Exceptions
- Categories
- Draft
- Contributor review
- Approval
- Published
- Acknowledged
Versioned, with section edit locks so contributors do not overwrite each other
Controls mapped per clause
- 3.1 Access is granted on least privilege2 controls
- 3.2 Privileged accounts are reviewed quarterly3 controls
- 3.3 Shared accounts are prohibited1 control
Authoring
Multiple contributors without collisions
Policies are structured into sections and bullets rather than stored as an opaque document, which is what makes clause-level mapping and concurrent editing possible.
- Contributors assigned per policy, drafting under section edit locks
- Documents and external references attached
- A policy audit log covering every change
- Acknowledgement campaigns with escalation for non-responders
| Action | asset-viewer | asset-coordinator | asset-approver | asset-admin |
|---|---|---|---|---|
| View | Allowed | Allowed | Allowed | Allowed |
| Create and edit | Not allowed | Allowed | Not allowed | Allowed |
| Submit for intake | Not allowed | Allowed | Not allowed | Allowed |
| Send to review | Not allowed | Allowed | Not allowed | Allowed |
| Send back | Not allowed | Allowed | Allowed | Allowed |
| Approve | Not allowed | Not allowed | Allowed | Allowed |
| Activate | Not allowed | Not allowed | Allowed | Allowed |
| Module settings | Not allowed | Not allowed | Not allowed | Allowed |
Every module ships bundles at this granularity. Segregation-of-duties conflicts are declared as rules, with logged exceptions.
Exceptions
Exceptions are a workflow, not a flag
An exception names the requirement it departs from, the compensating controls in its place and the stakeholders who must know. It follows an approval template you define and expires unless renewed.
- Configurable workflow templates with ordered steps
- Compensating controls recorded against the exception
- Reviews, renewals and renewal status tracked
- Risk rating, priority, stakeholders, notification and delegation rules
Treatment decision
- 1Treatment planActions with owners, priority, and due dates
- 2Action trackingStatus per action, SLA where defined
- 3ReassessmentResidual score recalculated after closure
Framework alignment
Works with your control frameworks
This module shares the platform control library. International standards, sector regulations and your own internal standard are loaded the same way and mapped to one another, wherever you operate.
Solutions by role
Built for your team
See policy management in your environment
A walkthrough scoped to your entities, your frameworks, and the way your programme is actually run.