21RISK is policy management software for the policies behind ISO 27001, SOC 2, NIS2, ISO 14001 and ISO 45001. Upload each policy, give it an owner, link the controls it covers and approve it. 21RISK records who approved it and when, keeps every earlier version and moves the policy to Needs review when the year is up.
Policies are a page on the Frameworks and Controls board, which every 21RISK organization has. Each row is one policy: the document, who owns it, who approved it and when, and the day it is due again. Click a control to see the policies that cover it.
An auditor rarely asks whether you have an information security policy. They ask who approved this version, when it was last reviewed and which controls it backs.
Someone approved the policy in a reply two years ago, or signed a page that now sits in another folder. Nobody can say which version that approval was for.
Most frameworks expect a review every year. The reminder belongs to whoever set it, and when that person changes job the policy goes out of date without anyone noticing.
The auditor picks a control, such as the quarterly access review, and asks which policy backs it. The answer is a spreadsheet tab somebody updates before each audit.
A policy in 21RISK is the document with a status, an owner and a review interval. Every step leaves an entry in its history.
The policy is your document, a PDF or Word file, with its appendices. Give it a name, an owner and the controls it covers, from any of your frameworks. It starts as Draft.
Move it to Approved, and 21RISK records who did it and on which day. A status rule can limit that step to a group such as Policy approvers.
A year after the approval, or after the interval you choose, the policy moves to Needs review by itself. Verify it if nothing changed, or upload the revised file and approve it again.
On 1 Sep 2025, version 1 was in force, approved 4 Mar 2025 by Henrik Lund.
Approving a policy means moving it to Approved. Put a status rule on that status, and only the people who match it can make the move, for example the members of a Policy approvers group. Everyone else with edit access can still prepare the policy and send it for approval.
The same rule can require that a file is attached, so nobody approves a policy that has no document. The policy page then shows the line an auditor looks for, such as “Approved 4 Mar 2026 by Henrik Lund”, and the table has an Approved by column.
Moving a policy to Approved records who did it and on which day. A reopened policy keeps showing its last approval until it is approved again.
Valid for a year after approval, for another interval, or in fixed periods that follow your audit year. An expired policy moves to Needs review.
Upload the revised file and the history keeps the one it replaced, with who changed what and when.
Link any control from SOC 2, ISO 27001, NIS2, ISO 14001, ISO 45001 or your own framework. Filter by a control to see the policies that cover it.
TABLESaved views, filters, search and Excel export, as in every 21RISK table. Keep a view of the policies that expire in the next month.
AI AND APIPolicies are in the REST API and the MCP server. Ask Claude which policies are due for review, or which controls have no policy behind them.
See where policies fit in each standard: ISO 27001 software, SOC 2 compliance software, NIS2 compliance software and ISO 14001 software. Every step is described in the help article on policies.
21RISK keeps more than 30 approved policies in this register, each linked to the controls it covers, as part of our own SOC 2 Type 2 programme. The policies are one part of that work. The controls they cover, and the findings that test those controls, are on the same platform.
Adopt a framework, write each control once and see which requirements still have no control.
FINDINGSLink an audit finding to the control it affects, give it an owner and a deadline, and follow it until it is closed.
COMPLIANCEHow requirements, controls, policies and findings fit together for every framework you answer to.
It keeps an organization’s written policies in one register and shows, for each one, who owns it, who approved it, when it must be reviewed and what it covers. In 21RISK a policy is the document itself with a name, an owner, a status, a review date, the controls it covers and a history of every change.
You decide, with a status rule on Approved: for example, that the user must be a member of a Policy approvers group. The same rule can require that a file is attached. Without a rule, anyone with edit access to the Frameworks and Controls board can approve, so add the rule before your first audit. Either way, 21RISK records who approved the policy and on which day.
A new policy is valid for a year after it is approved. You can choose another interval, fixed periods such as calendar years, or no review at all. 21RISK checks every hour, and a policy past its date moves to Needs review by itself, with the change in its history. If the review changes nothing, Verify records that the policy was reviewed today and starts the next interval. That is not a new approval: the policy keeps its last one.
Yes. When you revise a policy, you add the new file and remove the old one. The history keeps the earlier version, the day it was replaced and who replaced it, next to every approval. Together they show which version was in force on a date and who had approved it.
Yes. A policy can link any control from any of your frameworks. Filter the Controls column by a control, such as your quarterly access review, and the table shows every policy that covers it.
No. 21RISK does not send policies to employees to read and sign, and it does not collect acknowledgements. It is the register for the people who own, approve and audit the policies. Anyone with view access to the board can read every policy and open its documents.
No. There is no policy editor and no library of policy templates. You write the policy in the tool you already use and upload it as a PDF or Word file. 21RISK keeps the file, its approval and its history.
No. 21RISK has no e-signature. An approval is a change of status that only the people you allow can make, recorded with their name and the day. If a policy needs a signed copy, sign it outside 21RISK and upload the signed file as the policy’s document.
Policies follow the access to the Frameworks and Controls board, set under Settings › User Access by user or by group: view, create, edit and delete. Site access does not limit them. A policy belongs to a site, usually your head office, but anyone who can view the board can read every policy.
Policies, the controls they cover and the findings that test them, on the same platform as your sites and audits.