Policies and decisions

The rules you have written down, how a draft becomes a policy in force, and the record of what you decided and why.

Policies

Policies lists the rules you have written down, in language your team can follow. Each shows whether it is In force or still a draft, its version, and when it was last reviewed.

Your vCISO writes policies with you. Click Ask for a policy, or ask in any conversation. If you have none yet, ask for the one it thinks matters most for your business; it will draft it and explain why that one comes first.

A policy is written so you could hand it to a new employee and they would know what to do. Open one to read it in full.

From draft to in force

A new policy starts as a draft. A draft means nobody is following it yet, and your program page says so. When you have read it and are happy with it, tell your vCISO you are adopting it. It will mark it in force, or propose that for your approval if you have it set to ask first.

Revising a policy keeps the same policy and raises its version number, rather than creating a second copy. When your vCISO goes through a policy with you as a review, it updates the last reviewed date.

Whether policy changes are written straight away or wait for your approval is the Writing policies row on Settings. See You decide.

What a policy was based on

At the foot of a policy, What is this based on? shows the passages your vCISO read before writing it, when it looked anything up. If it did not, the page says there is nothing to check it against. See What is this based on?

Decisions

Decisions is What you decided: every call you made and the reasoning behind it, including the ones to leave something alone. It is what you reach for when somebody asks why.

Each entry shows the decision, the reasoning at the time, the date, and the area it belongs to. Your most recent decisions also appear under Lately you decided on Where you stand.

Your vCISO records decisions as they come up in conversation. Deciding to do nothing about a risk is a real decision, and it is recorded like any other.