> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Policies

> Create, approve, assign, and track acceptance of your organization's security and compliance policies.

The Policies page is where you create and manage all of your organization's compliance policies and procedures. Policies are approved internally, assigned to personnel groups, and accepted by employees in the employee portal — DSALTA records each of those steps as audit evidence.

## What policies are for

Compliance frameworks like SOC 2, ISO 27001, and HIPAA require your organization to maintain documented security policies and prove that employees have read and accepted them. The Policies module handles both — you store the policy documents here, approve them, and track who has accepted them.

## Viewing your policies

The policy list shows the following columns:

| Column            | Description                                                                                   |
| ----------------- | --------------------------------------------------------------------------------------------- |
| **Policy Name**   | Title of the policy (e.g., "Information Security Policy (AUP)")                               |
| **Type**          | `POLICY` or `PROCEDURE`                                                                       |
| **Frameworks**    | Frameworks the policy is mapped to. Two are shown; the rest collapse into a **+n** hover card |
| **Owner**         | Avatar of the person responsible, or **Unassigned**                                           |
| **Comments**      | Number of comments on the policy                                                              |
| **Status**        | **Approved** or **Not Approved**                                                              |
| **Last Approved** | Date of the most recent approval, or **N/A**                                                  |
| **Due Date**      | Review due date, or **No Due Date**. Overdue dates are highlighted in red                     |

Version history lives on the policy itself, and acknowledgments are tracked per employee — see [Approving a policy](#approving-a-policy) and [Assigning policies to employees](#assigning-policies-to-employees).

Click any policy row to open the detail panel: the policy content on the left, and a **Details** side panel on the right with **Controls** and **Comments** tabs.

## Creating a new policy

1. Navigate to **Data Library → Policies** in the sidebar.
2. Click **Create New Policy**. A sheet opens.
3. Fill in **Policy Name**, **Policy Description**, choose a **Type** (`POLICY` or `PROCEDURE`), and select at least one framework. All four are required.
4. Click **Next** to move to the content step, then write or paste the policy text in the editor. **Back** returns to the first step and **Cancel** discards the draft.
5. Click **Create Policy**.

<Note>
  Activating a framework pre-loads a library of policies and procedures into your organization — Access Control Policy, Incident Response Plan, Risk Management Policy, Third-Party Management Policy and around 60 others — so check the list before writing a new one from scratch.
</Note>

## Approving a policy

Open a policy and click **Approve** in the detail panel. The panel header shows **Last approved :** with the date of the most recent approval, or **Not approved yet**. Once at least one approval exists, a download button appears next to **Approve** so you can open the approved copy.

<Warning>
  **Editing the content wipes the approvals.** If you click the edit (pencil) button and save changes to a policy that has approvals, DSALTA warns that "Updating will overwrite the existing content and remove all current approvals. The policy will need to be re-approved after the update." This is not optional and there is no version history to fall back on — the previous content is replaced.
</Warning>

## Assigning policies to employees

Policies are assigned to **groups**, not to individuals, and the assignment is made from the group rather than from the policy:

1. Go to **Data Library → People** and open the **Groups** tab.
2. Open a group, find the **Policies** card, and click the **+** button.
3. In the **Policies** dialog, select the policies to add.
4. Click **Save Changes**.

Every current member of the group gets an acceptance record for each policy you add, and members added to the group later pick up its policies too. To remove a policy from a group, use the trash button next to it on the group's **Policies** card.

Each person receives an employee-portal invitation email when they are added to People, and you can re-send it to everyone from **Data Library → People** with the **Send Task Reminder** button.

## Tracking acceptances

Employees accept their policies in the employee portal, under **Accept security policies**, by clicking **I have read and I accept these policies**.

On the admin side, **Data Library → People** has a **Policy Approvals** column showing the accepted-vs-assigned count for each person, labeled **Completed** when the two match and **In progress** otherwise. Opening a person shows a **Policy acceptances** view, headed **Policies not yet accepted**, listing their policies with a checkmark against each one that is accepted.

## Related pages

* [Documents](/guides/data-library/documents)
* [People & Groups](/guides/data-library/people)
* [Training](/guides/data-library/training)