Policies: approve them, review them, keep every version ✨

Frameworks and Controls now has a Policies page. SOC 2, ISO 27001 and most other frameworks expect written, approved and regularly reviewed policies, and auditors ask for them first. Now they live next to the controls they back up.

The document is the policy. Upload it, PDF or Word, with any appendices. A revised version replaces it, and the policy's history records when.
Approved, with a record. Moving a policy to Approved records who approved it and when. The policy page shows both, and the list has an Approved by column. Add a status rule to decide who may approve.
Reviews come due on their own. Each policy must be verified every year unless you choose another interval, rolling or in fixed periods, just like findings. When it expires, it moves to Needs review.
One register. Anyone with access to the Frameworks and Controls board can read every policy, whatever sites they work on.