ISO 27001 Policy Documents

This is the help text the console shows in the help panel on this page.

Policy Documents

This page manages the eight core information security policies required by ISO 27001. Policies are the documented commitments of your ISMS and are reviewed during both Stage 1 and Stage 2 audits.

Policy Statuses

• Draft: AI-generated content that needs review and customization.
• Needs input: The AI identified open questions (e.g., policy owner names, specific thresholds) that must be answered before the policy can be published.
• Ready: All open questions answered — ready for publication.
• Published: The policy has been formally issued and is in effect.

Acknowledgment Progress

Published policies show how many employees have acknowledged them. ISO 27001 A.5.1 expects that staff are aware of security policies. The Overall Policy Acknowledgment Progress bar at the bottom tracks organization-wide completion.

Workflow

1. Click New Policy (the sparkle button) and confirm to generate all eight policies with AI. This overwrites any existing draft policies.
2. On a policy that shows Needs input, click Answer decisions and answer the AI’s questions.
3. Click Edit to refine the text in the Policy Editor.
4. Click Publish when the policy is Draft or Ready.
5. Click Send ack requests on a published policy to email employees and ask them to acknowledge it.