Policies
Write, approve, publish and review policies with version history, acknowledgements and links to controls.
Updated 2026-10-21
The Policies library holds your policy documents with full version history. A published, current policy counts as evidence for the controls it supports.
Set up your policy library
- Import what you have. Upload existing policies (PDF or Word). Document Intelligence extracts the text and suggests which controls each one supports.
- Fill the gaps. Start missing policies from a template or ask Fibo for a draft.
- Assign owners and reviewers for each policy.
- Set a review cadence, usually yearly.
Compare my policy library with the controls in my <program name> program. List controls with no supporting policy, then the policies I should write first to close the most gaps.
Lifecycle
- Draft a policy from a template or from scratch.
- Review with the people you assign. Comments stay on the version they were made on.
- Approve, recording who approved and when.
- Publish to your organization and collect acknowledgements.
- Review periodically on the schedule you set. Owners get a task before the due date.
Writing a policy with Fibo
Draft an <policy name> policy for a <industry> company of <headcount> people that satisfies <framework> requirements. Include purpose, scope, roles and responsibilities, policy statements, exceptions, enforcement and review cadence. Keep statements testable.
Review my <policy name> policy for statements an auditor could not test, and rewrite each as a specific, measurable requirement.
Linking to controls
Link each policy to the controls it supports from the policy's Controls tab. When the policy goes past its review date, linked controls show stale evidence until it is re-approved.
Acknowledgements
Choose who must acknowledge a published policy: everyone, a department or named people. Track completion on the policy page and send reminders to anyone outstanding.
Fibo
Ask Fibo to review the policy library for overdue reviews, or to move a policy through its lifecycle.