AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor IT and security teams who own the information security policy and everything under it. Each policy approved, sent to the people it covers, and on record by person and by version.
30-day trialUnlimited free viewersNo credit card required
acknowledged version 5.3
The security policy is the top of a set. Each policy under it reaches a different group, on its own review cycle.
The policy everything else hangs from, and the first document any auditor or customer asks for.
Everyone acknowledges it, and it is where consent to monitoring of company systems is set out.
Who gets what, who approves it, and how access is removed when people change roles or leave.
The plan your on-call team follows, current before the day it is needed.
How code and infrastructure change safely, for the engineers who make the changes.
Which tools are approved and what data goes into them, current as the tools change.
Wherever you operate, auditors, customers and regulators ask the same question: is the policy approved, current and known to the people it covers.
ISO/IEC 27001, clauses 5.2, 7.3, A.5.1
The policy and the topic policies under it are approved by management, communicated, acknowledged by the people they cover and reviewed at planned intervals.
PCI DSS v4.0, Requirement 12
The security policy is reviewed at least once a year, and personnel confirm at least once a year that they have read and understood it.
GDPR, Articles 24 and 39
Controllers put appropriate data protection policies in place, and staff who handle personal data are made aware of them.
Wherever you hold data
Breach notice, privacy and sector rules differ by country and by state. Each one gets its own addendum beside the core security policy.
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
Built for security leads who show policy control to auditors, customers and regulators, without chasing anyone.
Approvals, versions and acknowledgments are on record the moment they happen.
Engineering gets secure development, ops gets incident response, everyone gets acceptable use.
Invite someone with their tags and their policies are waiting.
Employees and other viewers are unlimited and free. You pay for the people who write.
Review and expiry dates remind each policy’s owner ahead of time.
Filter the record by date, person or policy and export a PDF or CSV.
Tag people by team and location. Each policy reaches only the people it covers, and new hires get theirs on day one.
Show the auditor who has acknowledged which version, with the time and the statement they agreed to.
Security writes the policy. Others approve it, and everyone else follows it.
Add your chief technology officer as the first approval step. The policy waits for them.
Management approval of the security policy, on record with the person and the date.
Engineering keeps the deployment procedure, ops keeps the runbooks, under the policy you set.
IT edits IT’s policies. HR, Finance and Safety edit theirs, side by side in one place.
Invite your virtual CISO or consultant as an external user to draft and review.
Share an approved policy with a prospect as a one-time viewer, or publish it on your trust page.
Auditors, customers and regulators ask the same thing in different words: the current policy, who approved it and who has it.
Export the record as a PDF or CSV, share one document with a one-time viewer, or publish a policy on your site.
Need help writing the policies? Find a consultant for your standard.
No. They read, acknowledge and sign as viewers, free of charge.
Both are available. Choose for each policy when you send it. e-sign is an add-on on the Scale plan.
The new version is approved, then sent to everyone it applies to, who are asked again.
Yes. Add them as a one-time viewer and they open that document with a one-time code.
Only when a policy changes or expires. If nothing changed at review, the date moves and no one is asked again. Where a standard expects a yearly acknowledgment, set the policy to expire each year and re-approve it.
Yes. Each department edits its own policies, and tags decide who reads them.
Their completed acknowledgments stay on record.
free for 30 days