Frameworks and Controls
Policies
Purpose Purpose
SOC 2, ISO 27001 and most other frameworks expect written policies: an Information Security Policy, an Acceptable Use Policy, an Incident Response Policy and so on. Each policy has to be approved, owned by someone and reviewed regularly, and an auditor will ask to see all three.
The Policies page in Frameworks and Controls keeps them in one register. For each policy you keep the document itself, who owns it, who approved it and when, and when it must be reviewed again. Every change is kept in the policy's history, so you can show which version was in force at any time.
This is relevant for whoever runs your IT or information security compliance, and for the people who own and approve the policies.
Who can see and change policies Who can see and change policies
Policies belong to the Frameworks and Controls board, and the board's access decides what each person can do. Manage it under Frameworks and Controls › Settings › User Access.
| Permission on the board | What it allows |
|---|---|
| View | Read every policy and its documents |
| Create | Add policies, including approved ones |
| Edit | Change policies, upload new versions and approve them |
| Delete | Delete policies |
Site access does not limit policies. A policy belongs to a site, but anyone who can view the board can read every policy, whatever sites they work on. See how access is controlled for how board access works in general.
Adding a policy Adding a policy
Open Frameworks and Controls › Policies and click New policy. Fill in:
- Document: the policy itself, PDF or Word, and any appendices that go with it.
- Name: for example "Information Security Policy".
- Site: an organization-wide policy belongs to your head office. If you have no head office site yet, create one under Sites.
- Owner: the person accountable for the policy and its reviews.
A new policy starts as Draft, and must be verified every year. The line under Owner shows the setting; click it to choose another interval or to remove it. See Reviews and expiration.
Documents and new versions Documents and new versions
The document is the policy. When you revise it, open the policy and add the new version under Files, and remove the old one. The policy's history records the earlier version and the day it was replaced, so you can show which version was in force when. With fixed periods, the files can also be shown period by period, each with the versions it had.
A policy can have several files, for example the policy and its appendices. The policy list shows the first file and how many more there are; click it to open them all.
Approving a policy Approving a policy
New boards come with four statuses for policies:
| Status | Open or closed | Meaning |
|---|---|---|
| Draft | Open | Being written or revised. The default for new policies. |
| Awaiting approval | Open | Ready for the approver. |
| Approved | Closed | Approved and in force. |
| Needs review | Open | The review is due. Expired policies move here. |
Approving a policy means moving it to a closed status, such as Approved. 21RISK records who did it and on which day. The policy page shows it under Status, for example "Approved Oct 10, 2026 by Jane Doe", and the policy list has an Approved by column.
When a policy is reopened, for example moved back to Draft for a revision, or expired to Needs review, the page shows its last approval: "Last approved Oct 10, 2026 by Jane Doe". Approving it again records a new approval.
To decide who may approve, add a status rule to Approved, for example that the user must be a member of a "Policy approvers" group. Without a rule, anyone with Edit access can approve, and anyone with Create access can add a policy that is already approved. Status rules apply to both. The board's Approve permission does not decide this for policies. You can also require a document before a policy can be approved, with the Files attached condition.
Statuses are managed under Frameworks and Controls › Settings › Status, like on any other board. You can rename them, add your own and add rules.
Reviews and expiration Reviews and expiration
A policy's review works like a finding with an expiration. The setting under Status says how often the policy must be verified:
- Rolling (the default for new policies): the policy expires one interval after it was last verified, for example a year after it was approved.
- Fixed periods: time is divided into periods, for example calendar years from 1 January, and the policy must be verified once per period. Use this when your reviews follow your audit periods. The activity and files on the right can then be shown period by period.
A policy is verified when it is approved. With rolling expiration, an approved policy whose review changes nothing can be verified again with Verify, next to Save. It records that the policy was reviewed today and starts the next interval. Add a comment in the same step, for example "Reviewed, no changes needed". Verifying is not an approval: the policy keeps its last approval.
21RISK checks for expired policies every hour. A policy that passes its expiration date moves to the board's expired status, Needs review on new boards, and the change shows in its history. Choose the expired status under Frameworks and Controls › Settings, in Policies due for review.
The policy list The policy list
The list shows each policy's number, status, name, document, owner, when it was last verified, who approved it, when it expires and its site. Like other tables in 21RISK, you can filter and sort it, resize and hide columns, and keep saved views, for example one with only the policies that expire in the next month. Export it to Excel from Actions.
The Frameworks and Controls board appears in Home and in the weekly digest once your organization has its first policy.
Deleting a policy Deleting a policy
Open the policy and click Delete policy at the bottom of the page. The policy leaves the list and cannot be opened or restored. 21RISK keeps its history. To retire a policy but keep it in the list, add a status such as "Retired" instead.
For API users For API users
- Policies are items of type
pon the Frameworks and Controls board. - New policies get a yearly rolling expiration unless
expiryIntervalAmountandexpiryIntervalUnitare given. Sendnullfor the amount to create a policy without one.expiryModeandexpiryAnchorwork as for findings. - Approve a policy by setting
statusto a closed status. Verify an approved policy with rolling expiration withverify: true. - Upload documents with
fileswhen creating a policy, and withaddFiles,removeFilesandrenameFileswhen updating one.