Policies

Policy register with live control mappings and AI-drafting provenance.

Total Policies

Published

In Draft / Review

AI-drafted (model recorded)

1 policy has no control mappings: Acceptable Use Policy. A policy that maps to no control is shelf-ware an auditor will flag - link it to the requirements it satisfies. (Computed live from policy_control_links, not asserted.)

Policy	Frameworks	Mapped Controls	Status	Version	Next Review	Owner
Information Security Policy Top-level information security policy establishing the organization's commitment to protecting information assets.	SOC 2 / ISO 27001	CC1.1A.5.1	Published	v2.1	2027-01-15	CISO
Access Control Policy Policy governing logical and physical access controls to TechCorp systems, applications, and data.	SOC 2 / ISO 27001 / HIPAA	CC6.1CC6.2CC6.3A.5.15164.312(a)(1)	Published	v1.3	2027-02-01	IT Manager
Incident Response PolicyAI-drafted Policy and procedures for detecting, responding to, and recovering from information security incidents.	SOC 2 / ISO 27001 / HIPAA	CC7.3CC7.4A.5.24164.308(a)(6)	Published	v1.0	2027-03-10	Security Operations Lead
Data Classification and Handling PolicyAI-drafted Policy defining data classification levels and corresponding handling, storage, and transmission requirements.	SOC 2 / ISO 27001	CC6.7A.5.12	In Review	v1.0	-	CISO
Acceptable Use Policy Policy governing acceptable use of TechCorp information systems, devices, and network resources by employees and contractors.	unmapped	none linked	Published	v1.2	2026-11-20	IT Manager

Synthetic demo register. Framework tags and control citations are joined live from policy_control_links → controls → frameworks - nothing typed in. Per the committed schema (db/schema.sql), a policy flagged AI-drafted must permanently record the model used; drafts from the Policy Generator are scaffolding for the named owner, never auto-approved.