Policies
Upload, review and version governing documents through their full lifecycle.
9 min read8 sectionsAll roles (delete is owners and admins only)
The Policies register records your organisation's governing documents: who owns each one, where it sits in its lifecycle, and when it is next due for review. Use it to add policy documents, record reviews, link policies to the controls and obligations they support, and export the register.
Open Policies from the sidebar to see every policy you have access to.
Search matches a policy's key or title only, not its description or document text. You can also filter by Organisational Unit, Status (including Other) and Category, or switch on Overdue only. "Showing N of M policies" tells you when a filter is hiding rows.
Register columns
- Policy ID
The policy's key, e.g.
POL-100, assigned when the policy is created.- Category
A category from your organisation's risk taxonomy.
- Owner
The person accountable for the policy. Shows Unassigned when nobody is set.
- Status
The lifecycle status (see Statuses). An Archived badge beside it means the document has been moved to long-term storage; owners and admins can click Request Restore on that row to retrieve it.
- Classification and Privilege
The two sensitivity markers. Privilege shows a dash for a non-privileged policy.
- Shared
Other organisational units this policy is also visible to.
- Next Review
Turns red with a warning mark once the date has passed.
- Controls
How many controls are linked to the policy.
Click a row, or its View button, to open the policy's detail page. Propose Update opens the edit form without leaving the register.
There are three ways in, and each one creates a proposal that an owner or admin must approve.
Upload Policy
The button at the top of the register. Attach the policy document and describe it. Use this for any policy that has a file.
New Policy
The button in the register toolbar. Records the policy's details and links without a document, including Classification, Privilege and Supersedes.
Import a register
Bring many policies in at once from a CSV or Excel file on the Uploads page. Imported policies have no documents attached.
- 1
Click Upload Policy
The Upload Policy dialog opens.
- 2
Attach the document
Click the drop area or drag a file onto it. Accepted: PDF, Word, Excel, PowerPoint, CSV, TXT or an image, up to 4 MB.
- 3
Complete the details
Check the title and add whatever else you know. Only the document and title are required.
- 4
Click Upload & Create Proposal
The file is stored and a proposal is created. The policy appears in the register once the proposal is approved in Proposals.
The fields you fill in when you add or edit a policy.
Upload Policy dialog, in the order shown
- Documentrequired
The policy file. It cannot be replaced later.
- Titlerequired
Fills in from the file name if left empty.
- Version
Free text. Defaults to
1.0.- Effective Date
When the policy takes effect. Defaults to today.
- Next Review Date
When the policy is next due for review. Drives the overdue flag.
- Review Frequency
How often you intend to review it. Starts at Not set.
- Status
One of the five lifecycle statuses. Defaults to Draft.
- Category
A primary and optional secondary category from your organisation's risk taxonomy.
- Approver
Free text — type a name or role, e.g. "CISO". It is not linked to a user account.
- Owner
Pick a user. Defaults to you if left unassigned.
- Organisational Unit
The unit that owns the policy. Defaults to the root unit.
- Also visible to
Other units that can view and link to the policy, but not edit it. Only owners and admins can set it; members see the field greyed out.
- Linked Controls
Controls this policy supports. Links are created when the proposal is approved.
The New Policy form uses the same fields without the document, and adds Classification (Public or Confidential), Privilege (Non-privileged or Privileged), Last Review Date, Supersedes Policy (Optional) and a link picker for each related register. Its approver field is labelled Approver ID (in the edit form, Approved By (Optional)) and is also free text.
A policy moves through five statuses. Change the status with Propose Update.
- Draft
Being written. The default for a new policy.
- In Review
Going through your internal review.
- Approved
Has passed review but is not yet in effect.
- Active
The current, in-force policy that governs your organisation.
- Retired
Withdrawn or superseded. Never flagged as overdue.
When an approved change first moves a policy into Approved or Active, or into Retired, everyone in your organisation is notified once; moving from Approved to Active sends nothing further. Confidential and Privileged policies are never announced. A status outside these five, usually from older imported data, shows as a grey badge and can be found with the Other status filter.
Record each review so the register shows when a policy was last checked and when it is next due.
- 1
Open the policy and click Record Review
The Record Policy Review dialog shows when the policy was last reviewed.
- 2
Enter the Review date
Defaults to today.
- 3
Enter the Next review date
Required. A completed review always sets the next one.
- 4
Click Submit for approval
Once approved, the policy's Last Review and Next Review dates update.
A policy's document cannot be swapped, so a revised document becomes a new policy that supersedes the old one.
- 1
Upload the revised document
Use Upload Policy with a new version number, and wait for approval.
- 2
Record what it replaces
Open the new policy, click Propose Update, and choose the previous policy under Supersedes Policy (Optional). The New Policy form offers the same field.
- 3
Retire the old policy
Open the previous policy and propose a status of Retired.
- 4
Activate the new one
When it takes effect, propose a status of Active.
The Supersedes link appears in the edit form and in the CSV export's Supersedes column.
Everything recorded about one policy, and the actions you can take on it.
The top of the page shows the Classification and Privilege badges and a summary card with the owner, business unit, Also visible to units, and a Days to Review countdown when a next review date is set. Below it are Policy Description, Policy Information (version, status, category), Timeline (effective date, next review, last review, last updated) and Ownership (owner and approver).
Linked records are listed under Linked Controls, Linked Obligations, Linked Risks, Linked Evidence, Linked Incidents and Linked Treatment Plans. Click one to open it. To add or remove links, use Propose Update and change the link pickers.
Propose Update
Edit any field or link. Creates a proposal.
Record Review
Log a completed review. Creates a proposal.
Delete
Owners and admins only. Takes effect immediately — see below.
Take the register out as a spreadsheet or a report.
Export CSV, above the table, downloads the policies currently shown, so apply filters first if you want a subset. The file includes both sensitivity columns, category, owner, approver, status, version, supersedes, the review dates and frequency, every linked-record group, Raised By and Date Added. For a formatted PDF, generate the Policies Register Report or the Policy Report (overdue reviews and reviews due ahead) from Reports.