Policy management software
Adopt 22 ready security policies, route each through an approval chain, publish only when every step has approved this version, and let the review dates compute themselves.
- AvailabilityIncluded for every GRCLens customer
- Library22 standard policies, eight sections each, in the same order
- LifecycleDraft, in review, approved, published, retired
- ApprovalOrdered chain (Owner, Reviewer, Approver by default), approved per version
- ReviewNext review computed from the cycle, 12 months by default
- DocumentsWord and PDF with document control, history, approval chain and page numbering
What policy management in GRCLens covers
Who it applies to
- Security, risk and compliance teams that own the policy set
- Organisations preparing for ISO/IEC 27001, SOC 2 or PCI DSS audits, which sample policy approval and review
- Regulated entities whose regulators expect approved, reviewed policies, such as under NCA ECC, the SAMA Cyber Security Framework or APRA CPS 234
- Teams replacing shared-drive policy folders and approvals by email
- Organisations keeping an AI system inventory under an AI management policy (ISO/IEC 42001)
A policy is a controlled document: it has an owner, a version, an approval record and a review date, and an auditor asks for all four. Policy management software keeps them together, so the published policy, the people who approved it and the date it is next due are never in three different places.
GRCLens follows the policy lifecycle draft, in review, approved, published and retired. A policy is published only when every step in its approval chain (Owner, Reviewer and Approver by default) has approved the current version. A rejection needs a reason and returns the policy to draft. Content is editable only in draft; after that it changes through a revision, and the published version stays in force until the revision is published.
Review dates are computed, never typed: the next review is the last review plus the policy's cycle, set when the policy is published and each time a review is recorded. A policy with no date shows as unscheduled rather than current, and the register shows what is overdue or due within 30 days.
Related reading: Cyber governance
How GRCLens supports Policy Management
Policy management is included for every GRCLens customer, and each library policy cites the ISO/IEC 27001 and NIST CSF 2.0 requirements it supports, so the documents your assessments ask for are written to be evidence.
22 security policy templates
Information Security, Acceptable Use, Access Control, Data Classification and Handling, Third-Party and Supply Chain Security, Incident Response Management, Business Continuity, Vulnerability and Patch Management, Cryptography and Key Management, AI Management, Risk Management and eleven more, adopted one at a time or all at once.
Statements that can be audited
Library text says shall, because a policy that hedges cannot be audited against. Every policy keeps the same eight sections in the same order and cites the ISO/IEC 27001:2022 and NIST CSF 2.0 requirements it supports, with NIST SP 800-53, PCI DSS and SOC 2 references where they apply.
Policy approval workflow
Steps are decided in order. The person who submitted a policy may decide only the Owner step, a rejection needs a reason, and changing the chain or revising the policy resets every step to pending.
Revision without a gap
Revising a published policy opens a new version in draft while the published version stays in force, so there is never a day without an approved policy while the next one is being agreed.
Policy review tracking
Overdue, due within 30 days, current or unscheduled, computed from the last review and the cycle. Recording a review sets the next date; nobody types one in.
Controlled Word and PDF documents
Each download carries a cover, a document-control table, the document history, the approval chain, contents, the classification in the header of every page and Page X of Y in every footer.
Your own policies too
Write or upload your own policies beside the library, through the same approval chain and review cycle, and export the register to Excel.
AI system inventory
The AI Management Policy requires an inventory, so it sits here: language models, machine learning models, agents, embedded features, vendor services and automations, each with deployment, status and risk rating, exportable to Excel.
Policy Management frequently asked questions
What is policy management software?
Software that runs policies as controlled documents through their lifecycle: drafting, approval, publication, review and retirement, with an owner, a version, an approval record and a review date on every policy, and documents an auditor can accept.
Which security policy templates are included?
Information Security; Acceptable Use; Data Classification and Handling; Access Control; Asset Management; Data Loss Prevention; Procurement; Third-Party and Supply Chain Security; AI Management; Business Continuity; IT Disaster Recovery; Incident Response Management; Change Management; Backup and Recovery; Logging and Monitoring; Vulnerability and Patch Management; Privacy and Data Protection; Physical and Environmental Security; Secure Development; Cryptography and Key Management; Remote Working and Mobile Device; and Risk Management.
How does the policy approval workflow work?
Each policy has an ordered chain, Owner, Reviewer and Approver by default. Steps are decided in order, the submitter may decide only the Owner step, and a rejection needs a reason and returns the policy to draft. The policy is published only when every step has approved the current version.
How are policy review dates tracked?
The next review date is computed: the last review plus the policy's cycle, 12 months by default and 6 months for the AI Management Policy. Each policy shows as overdue, due within 30 days, current or unscheduled, and an empty date is never shown as current.
Can a published policy be edited?
Not in place. Content is editable only in draft. A published policy changes through a revision, which goes back through the approval chain while the published version stays in force.
What does the exported policy document contain?
A cover, a document-control table, the document history, the approval chain with each decision, a table of contents and the policy text, with the classification in the header of every page and Page X of Y in every footer, in Word or PDF.
Is policy management an extra module?
No. Every GRCLens customer has policy management, whatever frameworks or modules it uses.
Talk to us about Policy Management
Security Solution Consultants provides security compliance services alongside the platform, so you can combine tooling with hands-on expertise.