Policy approval
Every Policy is a versioned definition, and the entity’s officer approves the Versions in force by Decision each period.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC5.3 | The entity deploys control activities through policies that set expectations and procedures that put them into action. |
| ISO27001 A.5.1 | Information security policies are defined, approved by management, published, communicated and reviewed at set intervals. |
| HIPAA 164.316 | The entity documents its security policies and procedures and retains that documentation for six years. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Policy in force during the report period. |
| Assert | Each Version in force appears in an officer’s approval Decision dated within the period. |
Owner
Example
A Studio-held entity runs Version 4 of its refund Policy. At period end the officer's approval Decision lists Version 4 among the Policies in force.