Write, review and publish a policy

Each framework comes with the policies and documents it requires. They start as MISSING until you add content, then go through review and approval.

Where: Dashboard → Compliance → Policies (or Documents), then click a policy to open it. Open Policies.

Documents work exactly the same way under Documents.

1. Add content

1. Open the policy and click Edit.
2. Under Content, choose Upload File or Link URL and add your file or link.
3. Under Ownership, set the Owner, Reviewer and Departments.
4. Under Schedule, set the Due Date for the next review (for example 12 months, or a Custom date).
5. Click Update. The policy is now a DRAFT.

No policy yet? For standard policies you can generate one with AI. Use Templates on the Policies page to download Vamu's policy templates.

2. Review and approve

1. The owner (or an admin) clicks To Review. The policy is now IN REVIEW, and its linked tests move to PENDING REVIEW.
2. The reviewer (or an admin) opens it and clicks Approve, or Reject to send it back to DRAFT.
3. Approving completes the policy's linked tests, which helps their controls pass. If the policy was overdue, its due date moves one year ahead.
4. Once APPROVED, click Publish to make it the live version (PUBLISHED).

Change an approved or published policy

Approved and published policies can't be edited directly. Click Renew to start a new version with your changes (at least one file is required when renewing with changes). Earlier versions stay under Versions → Version History.

Archive or restore

Click Archive on a published policy to retire it, and Restore to bring an archived one back. Archived policies are in the Archived tab.

Overdue policies

A policy past its Due Date is flagged Overdue. Renew it to start the next review.

Linked tests

The policy's Related Tests section lists the compliance tests it satisfies. Use Add to link another test, Remove to unlink one, or Restore default tests to go back to the framework's defaults.