Policy Management
Author, attest and enforce policy as code and as text.
Single lifecycle for every corporate, security and operational policy. Versioned drafts, mapped controls, role-based attestation, and policy-as-code hand-off to Link's Policy Engine for runtime enforcement.
What Policy does
Document lifecycle: draft → review → approve → publish → retire
Mapped to frameworks (ISO, NIST, NCA, SAMA, GDPR, DORA, EU AI Act)
Role-based attestation campaigns with reminders and escalation
Exception register with expiry dates and compensating controls
Bridge to Link Policy Engine (OPA/Rego) for runtime enforcement
Auto-revoke attestations when policy version changes
The Policy state machine
Policy enforces a controlled state machine — every transition is evidenced and audit-traceable.
Draft
Author in versioned editor; tag controls and frameworks.
Review
Route to legal, risk, security and business owners.
Approve
Electronic sign-off; lock immutable version.
Attest
Launch role-scoped attestation campaign.
Enforce
Publish policy-as-code bundle to Link Policy Engine.
Evidence in, outputs out
Policy reads live signals from the operating estate and emits regulator-ready outputs — no shared drives, no spreadsheets.
Evidence sources (in)
- Nexus HR-driven org chart (who attests what)
- Link Policy-as-code evaluator runs
- Audit Management findings tagged to policy gaps
Outputs (out)
- Attestation completion reports per policy / function / region
- Policy-to-control coverage heatmap
- OPA bundles published to Link for runtime decisions
Crosswalked to what regulators ask for
Used in these business solutions
Policy Management is composed into outcome-led iShield solutions.
Run Policy on iShieldGRC.
Stop running policy in spreadsheets and email threads. See it on a live evidence ledger.