Policies

Policies are formal documents that describe your organization's rules, procedures, and standards for security and governance. Auditors expect to see documented policies for every compliance framework, and Claw GRC provides version-controlled policy management with approval workflows.

Policy Lifecycle

Policies in Claw GRC move through a defined lifecycle:

Statuses

Status	Description
draft	The policy is being written or revised. Not yet effective.
in_review	Submitted for approval. Pending review by an authorized approver.
approved	Reviewed and approved. This is the active, effective version.
archived	Superseded by a newer version or retired. Retained for audit trail.

Creating a Policy

1. Navigate to Policies in the sidebar
2. Click Create Policy
3. Enter the policy details:
   • Title -- A descriptive name (e.g., "Information Security Policy")
   • Content -- The full policy text (supports rich text formatting)
4. The policy is created in draft status with version 1

Versioning

Each policy has a version number that increments when approved changes are made. The version history is preserved in the audit trail, so auditors can see what changed between versions and when.

When you need to update an approved policy:

1. Create a new draft from the existing policy
2. Make your changes
3. Submit for review
4. Upon approval, the version number increments

Policy Content Structure

While Claw GRC does not enforce a specific template, most compliance frameworks expect policies to include:

• Purpose -- Why this policy exists
• Scope -- Who and what it applies to
• Policy Statements -- The specific rules and requirements
• Roles and Responsibilities -- Who is responsible for implementation
• Exceptions -- How to request an exception to the policy
• Review Cadence -- How often the policy is reviewed (typically annually)
• Approval -- Who approved the policy and when

Mapping Policies to Controls

Policies can be linked to unified controls to demonstrate that your organization has documented governance for specific compliance areas. Common policy-to-control mappings:

Policy	Example Controls
Information Security Policy	Access control, data classification
Acceptable Use Policy	Asset management, user responsibility
Incident Response Plan	Incident detection, handling, recovery
Data Retention Policy	Data lifecycle, privacy, storage
Change Management Policy	Change control, configuration management
Business Continuity Plan	Availability, disaster recovery

API Endpoints

Method	Endpoint	Description
GET	/api/v1/policies	List policies
POST	/api/v1/policies	Create a new policy
GET	/api/v1/policies/:id	Get policy details
PUT	/api/v1/policies/:id	Update a policy
DELETE	/api/v1/policies/:id	Delete a policy

Tips and Best Practices

• Start with essential policies -- SOC 2 typically requires an Information Security Policy, Acceptable Use Policy, Change Management Policy, Incident Response Plan, and Data Retention Policy at minimum.
• Review annually -- Most frameworks require annual policy reviews. Use the audit trail to demonstrate your review cadence.
• Get documented approvals -- Ensure policies are formally approved by an authorized person. The approval timestamp and approver are recorded in the audit trail.
• Keep policies concise -- Long, complex policies are less likely to be read and followed. Write clear, actionable policy statements.
• Version control everything -- Never edit an approved policy in place. Create a new version, go through the approval workflow, and maintain the full version history.