Policy Engine

The One Compliance includes a policy management engine for creating, versioning, approving, and distributing organizational policies. Policies are linked to framework controls as evidence.

Built-in Policy Templates

The One Compliance provides ready-to-use policy templates that you can customize for your organization:

Template	Description
Acceptable Use Policy (AUP)	Rules for acceptable use of company systems and data
Incident Response Plan	Procedures for detecting, responding to, and recovering from security incidents
Data Classification Policy	Definitions for data sensitivity levels and handling requirements
Access Control Policy	Rules for granting, reviewing, and revoking user access
Password Policy	Password complexity, rotation, and storage requirements
Change Management Policy	Procedures for requesting, approving, and implementing changes
Business Continuity Plan	Procedures for maintaining operations during disruptions
Disaster Recovery Plan	Procedures for recovering IT systems after a disaster
Vendor Management Policy	Requirements for evaluating and managing third-party vendors
Data Retention Policy	Rules for how long data is stored and when it is destroyed
Remote Work Policy	Security requirements for employees working remotely
Encryption Policy	Standards for data encryption at rest and in transit

Using a Template

1. Navigate to Compliance → Policies
2. Click New Policy → From Template
3. Select a template
4. Customize the content for your organization (company name, specific requirements, etc.)
5. Click Save Draft

Creating Custom Policies

To create a policy from scratch:

1. Navigate to Compliance → Policies
2. Click New Policy → Blank
3. Enter the policy title, description, and category
4. Write the policy content using the rich text editor
5. Link the policy to one or more framework controls
6. Click Save Draft

Policy Versioning

Every policy change creates a new version:

• Draft — Policy is being edited and is not yet published
• Pending Approval — Policy has been submitted for review
• Published — Policy is active and visible to employees
• Archived — Policy has been superseded by a newer version

The full version history is preserved. You can view and compare any two versions side-by-side from the Version History tab on any policy.

ℹ️Published policies cannot be edited directly. To make changes, create a new draft version from the current published version.

Approval Workflows

Policies can require approval before publication:

1. Author creates or updates a policy and submits it for approval
2. Reviewer receives a notification and reviews the policy
3. Reviewer approves or rejects the policy with comments
4. If approved, the policy is published automatically
5. If rejected, the author is notified and can revise the draft

Configure approval workflows in Settings → Compliance → Policy Approval. You can set required approvers by policy category or require multiple approvers for critical policies.

Employee Acknowledgment Tracking

After a policy is published, you can require employees to read and acknowledge it:

Setting Up Acknowledgment

1. Open the published policy
2. Click Require Acknowledgment
3. Select the target audience (all employees, specific departments, or specific roles)
4. Set an acknowledgment deadline
5. Click Send

Employees receive an email notification with a link to read and acknowledge the policy.

Tracking Acknowledgments

The Acknowledgments tab on each policy shows:

• Total employees who need to acknowledge
• Number who have acknowledged
• Number who have not yet acknowledged (with names)
• Acknowledgment timestamps

Overdue acknowledgments are highlighted and can trigger automated reminder emails.

Acknowledgments as Evidence

Employee acknowledgment records automatically serve as compliance evidence for workforce training and policy awareness controls. The acknowledgment data is linked to the relevant framework controls.

⚠️Acknowledgment records are immutable. Once an employee acknowledges a policy, the timestamp and policy version are permanently recorded in the audit trail.