# Policies

> Write, approve, publish and review policies with version history, acknowledgements and links to controls.

Source: https://docs.csquaregrc.com/guides/policies


The **Policies** library holds your policy documents with full version history. A published, current policy counts as evidence for the controls it supports.

## Set up your policy library

1. **Import what you have.** Upload existing policies (PDF or Word). Document Intelligence extracts the text and suggests which controls each one supports.
2. **Fill the gaps.** Start missing policies from a template or ask Fibo for a draft.
3. **Assign owners and reviewers** for each policy.
4. **Set a review cadence**, usually yearly.

```text
Compare my policy library with the controls in my <program name> program. List controls with no supporting policy, then the policies I should write first to close the most gaps.
```

## Lifecycle

1. **Draft** a policy from a template or from scratch.
2. **Review** with the people you assign. Comments stay on the version they were made on.
3. **Approve**, recording who approved and when.
4. **Publish** to your organization and collect acknowledgements.
5. **Review periodically** on the schedule you set. Owners get a task before the due date.

## Writing a policy with Fibo

```text
Draft an <policy name> policy for a <industry> company of <headcount> people that satisfies <framework> requirements. Include purpose, scope, roles and responsibilities, policy statements, exceptions, enforcement and review cadence. Keep statements testable.
```

```text
Review my <policy name> policy for statements an auditor could not test, and rewrite each as a specific, measurable requirement.
```

## Linking to controls

Link each policy to the controls it supports from the policy's **Controls** tab. When the policy goes past its review date, linked controls show stale evidence until it is re-approved.

## Acknowledgements

Choose who must acknowledge a published policy: everyone, a department or named people. Track completion on the policy page and send reminders to anyone outstanding.

## Fibo

Ask Fibo to [review the policy library](/fibo/policy-inventory) for overdue reviews, or to [move a policy through its lifecycle](/fibo/policy-lifecycle).