Adapting policies to your organization

Implementing security policies that align with your organization’s specific needs is crucial for effective compliance. Our platform offers two types of policy templates to assist you in this process:

• Formal (Minimum Viable Policies): These templates cover essential security guidelines.
• Comprehensive: These are more detailed policies that include stricter requirements, ideal for organizations aiming to adopt comprehensive frameworks like ISO 27001 in the future.

Adapting Policies

When customizing the templates, focus on adjusting the language to reflect your organization’s practices without altering the core intent of the policies. We recommend retaining most of the guidelines but adapting the wording to fit your organizational setup.

Example:

• Original Policy Statement:

  1. Keys and key cards are provided to a subset of employees and are granted on a needs-oriented basis.

• Adapted Policy Statement (if using pin codes instead of keys):

  1. Access pin codes are provided to a subset of employees and are granted on a needs-oriented basis.

This ensures the policy remains relevant and accurately represents your security measures.

For certifications like SOC 2 Type II, it’s essential to demonstrate that your organization follows its stated policies and procedures. Our platform’s controls are designed to guide you in providing the necessary evidence.

Publishing draft policies

On the Policies page, choose Publish draft policies to publish drafts that don’t require review. The confirmation lists policies that still need review; these remain unpublished. Open each listed policy to submit it for review or complete its review.

After publishing, the notification reports how many policies were published and explains any failures. Resolve the reported issue before retrying. You can also open an eligible draft and publish it individually.

During onboarding, review-required policies also remain unpublished. Choose Save as drafts to finish setup and review them later. If publishing only partly succeeds, the remaining drafts and your selections stay available so you can retry.

Reviewing Policy Changes

When a policy is submitted for review, reviewers can compare it with the latest published version and leave comments on specific lines. The policy author and assigned reviewers can discuss a comment through replies, while the reviewer retains control over resolving or reopening the thread.

Open comments do not prevent approval, so reviewers should resolve completed discussions before publishing when possible. Resolved discussions remain visible in the policy review context.

Need Assistance?

If you have questions about specific guidelines in the policies or need help applying anything to your organization, please don’t hesitate to reach out. We’re here to help ensure that your security program is both effective and tailored to your company’s unique needs.

Remember: The goal is to maintain best security practices while making policies practical and applicable to your organization’s environment.