Write, approve, publish and track your policies in one register

The policy register

Each entry records the policy title, owner, current version, approval status, last review date and next review date. When someone asks for the current acceptable use policy, there is one place to look.

• Title, description and scope
• An owner and a backup owner
• Version number, approval status and effective date
• Review schedule set per policy
• Tags and categories for filtering

Authoring and approval

A policy moves through draft, review, approval and publication, and is eventually retired. The author writes, the reviewer checks and the approver signs off.

Each action is recorded in the activity log. When an auditor asks who approved the data classification policy and when, you can show them the entry.

Draft

The author creates or updates the policy. Drafts are visible only to the author and the named reviewers.

Review

Reviewers check the policy for accuracy, completeness and fit with your standards. Their comments are kept with the draft.

Approve

The approver signs off, usually the CISO, CTO or compliance officer.

Publish

The policy takes effect. Earlier versions are archived and stay available.

Policy acknowledgements

Auditors want to see that staff have read the policies that apply to them. Certifyi sends published policies to employees by role, by department or by name, and records who has acknowledged each one.

When a policy changes, you can send the new version out again, so you can show who has accepted the version currently in force.

Procedures and guidance beside policies

Procedures, guidelines, how-to notes and FAQs are not formal policies, but staff still need to find them, and auditors often ask for the procedure that puts a policy into practice. Wherever they are kept, give each one an owner and a date, and make clear which policy it supports.

Someone who needs to know how to report a phishing email should find the procedure without asking in a chat channel. The policies themselves sit in the register, with their version history.

Keeping policies under review

Each policy needs a review cycle. ISO 27001 expects policies to be reviewed at planned intervals and when significant changes occur. When a review falls due, the owner checks the policy, updates it if needed and sends it back through approval.

A policy last reviewed three years ago is one of the most common audit findings. Regular reviews are how you avoid it.

• Review cycle set per policy: yearly, every six months, quarterly or a custom interval
• A next review date recorded on each policy
• A review checklist covering accuracy, regulatory fit and who the policy applies to
• Overdue reviews followed up with the owner

Version history and activity log

Each change to a policy creates a new version. You can compare two versions to see what changed and who changed it, and auditors can see the full history.

Creation, edits, review comments, approval, publication, acknowledgement and retirement are all recorded in the tamper-evident activity log that the reporting module reads.