Policies

Use this when…

• you need baseline policies for audit/certification readiness (SOC 2 / ISO 27001 are common examples)
• customers ask for policy excerpts (security, access, incident response, vendor mgmt)
• you want a clean approval + version history

Recommended workflow

1. Start with a small baseline set of policies you can defend.
2. Keep policies short and operational (avoid “we will” with no actual mechanism).
3. Use versioning intentionally: update policies when real practice changes.
4. Use Training & Acknowledgement for attestation.

Policy directory (/policies)

The directory can be filtered by framework, status, type, and owner. It shows policy ID, version, name, type, description, status, linked controls, frameworks, review date, owner, and last update. You can create from a template, approve eligible policies, or download the master document list.

Policy editor (/policies/[id])

The editor combines rich document content with operational properties:

• status and policy type
• owner and frameworks
• current version
• review cadence and next review date
• description and linked controls
• history and earlier versions

Approved policy versions are read-only. To change one, create a new draft, edit it, review the changes, and approve the new version. Reverting or restoring creates traceable history; it should not erase the fact that an earlier version existed. The PDF export is useful for distribution, while the stored version and approval history remain the compliance record.

Cortex can suggest controls based on policy content. Treat suggestions as candidate mappings: confirm that the policy actually governs the control and that operational evidence exists independently.

Policy acknowledgement

Approving a document and acknowledging it are different events. Approval records management authorization; an acknowledgement campaign records that assigned personnel attested to a particular policy version. Run acknowledgement from Awareness and reassign it after material policy changes when your program requires renewed attestation.

Compliance angle

• SOC 2: policies support “control design” and can back up your narratives.
• ISO 27001: policies are part of your ISMS; they should connect to risk and procedures.
• GDPR: privacy/security policies and vendor management policies support accountability.