Policies & controls

Assessments tell you what to do; policies and controls are how you show you’re doing it. This section covers generating policies, storing them, and maintaining the controls library that ties everything to your frameworks.

Policy Generator

Create policies tailored to your organisation: Information Security, Data Protection, Acceptable Use, Remote Working, Incident Response, Password, BYOD, Third Party & Supplier, Business Continuity and Access Control.

Go to Policy & Process → Policy Generator, or follow a Generate link from a gap.
Pick the policy type and check its settings, such as your patch window, review cycle or retention period. They are written into the policy exactly as you set them.
Select Generate policy. Each type follows a fixed blueprint: the same sections, in the same order, every time, each covering the points your frameworks look for. The policy is written section by section and saved as a draft in the Policy Vault.
If a section couldn’t be written, you’ll see which one, with Generate missing sections.
Open it in the Policy Vault to review it, approve it and export to PDF, branded with your logo and an ownership block.

Regenerate rewrites every section of the same draft. If that policy was already approved, regenerating starts a new version that needs approving again.

Policy Vault

The Policy Vault stores your policies with draft, active and archived status and a version number, so you always know which version is current.

Approval and controls

Each policy’s page has an Approval and controls panel:

Sections and controls. Every section lists the security controls it covers, such as patch management or incident response. Sections of a generated policy are linked automatically. For a policy you wrote yourself, its headings become sections, and you can tag a control to each one.
Approve. Approving the current version marks every linked control as Documented, in every framework you assess. A policy with missing sections can’t be approved.
Documented is not Evidenced. A policy shows you’ve written down what you do. Only live data, such as scans, directory sync or register entries, makes a control Evidenced. The Capabilities page and the assessment wizard show the two labels side by side and never merge them.
New versions. Editing or regenerating an approved policy starts a new version. Its controls stop counting as Documented until that version is approved. Revoke approval or Archive removes the Documented status straight away.

In an assessment, questions that a policy answers show Documented: covered by §

(version, approval date). Nothing is answered for you: confirm the citation, or choose Not this policy. Where no approved policy covers a documentation control yet, the gap analysis and the Capabilities page offer Generate .

Controls Vault

The Controls Vault is your security controls library:

Create controls and describe how you meet them.
Tag each control to frameworks — and let AI validation check that a control genuinely satisfies the framework requirement it claims.
Link controls to the assets and people they apply to, and attach evidence.

Because controls are tagged to frameworks, they feed straight back into your compliance scores and cross‑mapping — so the work you do on one control is visible everywhere that control is relevant, and the evidence you attach to it can be reused against every framework that asks the same question.

How it fits together

Assessments identify gaps.
Controls record how you close them, tagged to frameworks and linked to assets/people.
Evidence proves it.
Policies document the rules behind it.

Together these produce a defensible, self‑maintaining compliance position rather than a folder of stale documents.

Why it matters

For everyday security: clear, current policies set expectations for your team, and a controls library keeps your safeguards documented rather than tribal knowledge.

For compliance: policies and a mapped controls library, with evidence, are exactly what an assessor asks for. The branded PDF export, versioning and approval workflow give you auditable artefacts on demand.

Next: Reports →