PolicyCo

Managing Policies A Better Way - With Articles

2020-01-30T20:24:00+00:00

At PolicyCo, Articles are the building blocks of every document. Each Article has a name, sequence number, an author, related controls (more about that later), attachments, and, most importantly, content. We believe articles are a useful way to build your policies because they give you the ability to manage individual slices of a document in a non-linear way. Whether you are creating a new policy from scratch, managing an existing policy, or doing an annual review, there are several benefits to managing your documents in this modular way.

1 - Dividing your policy into easily assigned, edited, and managed pieces

When embarking on the policy writing process, there are times when a single author isn’t best suited to writing an entire policy. Whether this is due to a writer’s area of expertise or schedule, it is often helpful to have collaboration between multiple authors. Articles allow for individual authoring assignments within a policy. Articles dealing with technical aspects of a given policy can be assigned to members of the tech team, while more Articles with a more legal focus can be given to the legal team to write and edit. In some cases, it might be a good idea to assign multiple authors to a single Article.

2 - Specific points of association - Images, media, controls, and procedures

Having a single policy made up of a collection of Articles allows for a more precise association of assets and information to each block of content. There are multiple types of content associations that can be made to an Article. Procedures are the first type of content that can be attached to an Article. In the most common cases, a simple process for complying with a piece of a policy is required. For instance, if a Security Policy calls for changing passwords every 30 days, the associated Procedure would include the individual steps for making that password change. For compliance purposes, regulatory controls can also be associated directly with an Article (e.g., GDPR, NIST, HITRUST, etc.). Adding individual controls to an Article makes future updates, and compliance audits much easier due to the ability to search either by Article text or by Control. Finally, with PolicyCo, you can also attach files directly to an article. These attachments can range anywhere from screengrabs, documents, or video files.

One of the challenges when managing large policies is identifying which concept should be mapped back to a specific control. A policy can contain dozens of concepts. We refer to these concepts as articles. By dividing your policy into discrete articles, it’s much easier to make specific references to the relevant text.

The old way: Control abc.10 is tied to paragraph 5 of our Aquisition Assessment PolicyThe new way: Write the article and then link the control directly from the controls tab.

3 - Non-Linear incremental updates

With Articles, you can write, review, approve, and publish your policies in a non-linear fashion. Due to the nature of how Articles are used to create policies within PolicyCo, an organization can post a policy for immediate use by the employees, while continual incremental improvements are made to individual sections. When the author is happy with their work, they can submit their Article(s) to the project manager for review and publishing. Once approved and published, the Article seamlessly folds into the overarching document with no need for additional formatting or styling. With this publishing process, updates can be made to the “live” document efficiently without interrupting the organization’s usage of the currently approved policies. An additional benefit of this type of architecture is the ability to version control specific sections within a document instead of having specific version numbers for an entire policy [althought, if that is your preference, it’s something you can do].

PolicyCo is the only online policy management tool that allows Article based organization. Other systems require that you enter policies as one large chunk. While this certainly is a straightforward approach, the tradeoff is that you will not have useful specificity for the procedures, controls, and attachments for a given policy. We feel really confident about the approach we’ve taken with Articles within PolicyCo and would invite you to try them for yourself.

Let us know what you think.

3 Ways to Organize Your Policies

2020-01-22T08:00:00+00:00

In our “Q uick Overview of PolicyCo” article, we discussed how we think about Articles as the most basic units of content within a policy. Whether you are starting your policy writing from scratch, or have a set of existing documents that you are pleased with, deciding how to separate that information into articles within PolicyCo is an important step. With that in mind, here are several approaches to organizing policies into articles that have worked for our team.

1 - Broad Strokes - This approach is a great way to get started. By breaking individual policies down into just a handful of larger chunks, you gain the benefit of standardizing the structure of your documents, while also being expedient. Where a more granular approach can require extra thought and consideration, the broad strokes approach allows you to arrange your policy quickly and easily. The most simple use-case would include two articles for a policy - for instance, Purpose and Policy Statement.

2 - Hyper-Granular - This strategy is best suited to organizations and administrators who want individual control over every paragraph within a policy. With this style of policy writing, what you are giving up in terms of speed is made up for with additional flexibility and specificity. By breaking your policies up into smaller pieces, you are allowing each piece to carry its own attachments, procedures and controls. Not to mention, you can assign multiple authors to individual articles within a single policy.

3 - Hybrid - Since there is no one size fits all approach to policy writing, what works for one policy might not work for another. For instance, a Time Off and Leaves of Absence policy that includes guidelines for holidays, PTO, FMLA, and bereavement leave might warrant a more granular approach. However, something like a Smoke-Free workplace might only require a Purpose and Policy Statement.

Regardless of the approach that you choose, writing and distributing simple and clear policies is vital to the success of your organization. Whether you are trying to communicate the values of your business or are working toward compliance for HIPAA, HITRUST, or SOC2, being thoughtful upfront about how you organize your articles will save you time and effort down the line.

Employee Handbooks and Your Small Business

2020-01-17T21:49:00+00:00

Writing and reading employee handbooks can be tedious, so it isn’t surprising that many small businesses skip over them entirely. When your team is small, it may seem easier to talk about ideas, policies, and procedures as they come up in an ad-hoc way.

However, employee handbooks are useful for many reasons. Avoiding working on one because it’s not fun can cause you pain and strife down the road, including high staff turnover or even lawsuits. Effective handbooks clearly state expectations between the employer and employee. When everyone is on the same page, there are fewer risks to the employee, the employer, and the business as a whole.

As a small business owner, it’s not enough to just have a basic, boilerplate employee manual. It needs to be both useful and engaging. If it doesn’t meet those two criteria, it’s probably not going to get read. It’s not going to do you any good if it just sits on a shelf collecting dust.

Useful

The basic purpose of an employee manual is to get everyone on the same page when it comes to expectations. Employees need to understand what their role is within the business and how they’re expected to reflect the values of the brand.

When expectations are clearly stated upfront, you will be better able to recruit quality employees and prevent high turnover. In an increasingly millennial workforce, this is crucial. According to a study from Gallup, 21% of millennials say that they have changed jobs within the past year. That number is three times higher than non-millennials. Preventing turnover is essential today.

It’s important that you only include the information that your employee absolutely needs. Employees will be much more likely to read through an entire employee manual if it is focused and relevant to their position.

For instance, Nordstrom’s employee handbook contains only one rule: “Use good judgment in all situations.” If that’s all you need, then that’s all you need. Don’t bog down employees with unnecessary information. While your business may be a bit too complex for a single-line handbook, the idea remains the same: Say what they need to know and say it quickly.

Engaging

When thinking about handbooks, benefits information, onboarding materials, and basic information about the way the business functions probably come to mind. None of these topics are particularly engaging.

To make things a little bit more interesting, some notable companies have opted for a more innovative employee manual design. This approach leaves the basic, boilerplate information out of the employee manual and instead offers that information digitally.

For a small business, this approach might be a bit much. However, there is no reason a web-based employee manual can’t be an engaging mix of both aspirational brand values and informative policy information. Your handbook or manual should focus on helping the employee better understand the business, their role within it, and the company’s brand and values.

Employee manuals don’t need to be endless pages of boring corporate information. You are in control of what it contains. What do your employees need to know about working in your organization? What does it mean to be a part of your team? What is acceptable and unacceptable behavior? With a well-written employee handbook, you and your team will work together like a well-oiled machine so that your business can thrive and grow.

PolicyCo Weekly Update - 10.11.2019

2019-10-11T17:00:00+00:00

It has been another busy week here at PolicyCo.

This week the team has been focused on making updates to the dashboard, article editor, and some work under the hood. Here’s a quick look at what’s gotten some attention this week.

First Time User Flow Updates
Article Editor UI Updates
Dashboard UI Updates
Updated site to Angular 8.2.9
HelpHero Product Tour (to deploy on Monday)
Article Editor Tabbing Behavior - Now tabbing affects bullets, numbered lists, and paragraphs. (to deploy on Monday)
Miscellaneous Bug Fixes

As noted above, there were a couple of features that were wrapped up at the end of the week that will be deployed on Monday morning. Some other items on next week’s list include more dashboard enhancements and a better onboarding flow for new users.

If there is anything that you think we’re missing, or should move up in our queue, feel free to reach out to us. If you have any questions about how PolicyCo can help your policy process, we’re always happy to have that conversation.

PolicyCo Weekly Update - First Edition

2019-10-04T12:00:00+00:00

Welcome to the first edition of our PolicyCo Weekly Update.

We are excited about the progress that we’ve been making over the past several months at PolicyCo. Since the August 1 launch of the first iteration of the app, the team has been working on new features, enhancements, bug fixes and improvements. Moving forward, this is where we will be sharing a quick overview of our latest releases and upcoming plans for the future of PolicyCo.

This week’s progress includes:

Re-launched our website on Tuesday, October 1
Deployed an updated version of the user dashboard
Added organizational whitelisting so that new users with your company’s email address can join your organization without an invitation
Added the ability to copy the settings from one policy to all other policies within an organization
Updated and refined several UX/UI components

Policy Structure

2019-08-12T14:00:00+00:00

One of the more challenging aspects of creating policies for an organization is deciding on which categories to begin with. Maintaining 40-60 policies can overcomplicate an already complicated process. I found an article from February 2014 by David Lineman called How to Structure Information Security Policies, that resonated with me. In this article, he offers advice on how which categories to start out with.

As I reviewed these with our CISO, we found that David’s approach did a good job of providing needed structure to our diverse (scattered) list of policies. I’d encourage you to read his article and I’ve also provided the list of policies below:

IT Risk Management Policy (Risk Assessment)
Security Program Policy (Policy, Planning, Personnel)
Asset Management Policy (Inventory, Acceptable Use, Protection)
Information Management Policy (Collection, Classification, Storage, Disposal)
Third Party Security Policy (Assessment, Contracts)
Personnel Security Policy (Screening, training, termination)
Access Control Policy (Systems, Accounts, Passwords)
Network Security Policy (Firewalls, Structure, Wireless)
Physical Security Policy(Visitors, IT Systems)
Operations Management (Configuration, Change Control, Malware)
Application Security Policy (Development, Testing)
Security Incident Management Policy (Reporting, Response, Investigation)
IT Business Continuity Policy (backup, Business Continuity)
Security Monitoring Policy (Logging, Audit, Monitoring)
Customer Privacy Policy
Employee Data Privacy Policy

Another key takeaway from the article stresses the importance of keeping policy statements separate from procedure or standards statements. This is another firmly held belief at PolicyCo. Policies are all about intention in a generic sense while procedures and standards are provided for specificity.

Policy - Files are backed up nightly.

Procedure - A backup script runs on server A in /bin/backup.sh. It backs up database servers x, y and z. Joe Smith is responsible for its proper nightly operations and alerts go to noc@policyco.io if it fails.

The breakdown of Policy documents listed above is also convenient for separation of duties ensuring the appropriate technical teams have access to the policies that affect their daily duties, particularly as it relates to technical vs management teams.

As with most things, there are many ways to organize information. I hope this has helped you in your decision making process. Special thanks to Mr. Lineman and informationshield.com.

PolicyCo is Live!

2019-08-01T14:00:00+00:00

After 9 months of planning and development, the first phase of PolicyCo is in production. All customers get a 30 day free trial. Baseline features include:

Unlimited users per organization
$50/mo first policy $5/mo per additional policy
Create unlimited articles within each policy
Assign project manager / owner / billing / author / viewer / billing roles
Set font and size from project manager role
Draft and publish authority / history
Subscription management
User invitation and management
Create / delete sections
Create / delete articles
View policies online
Download policies as pdf

In the coming weeks we will be adding:

Attachments
Evidence
Sockets for live co-editing
Bulk assignments
More robust invitation flow
.doc / docx downloads

Are we missing something critical to your needs? Let us know at support@policyco.io.

A Quick Overview of PolicyCo

2019-08-01T00:00:00+00:00

PolicyCo was born because a typical word processor doesn’t have the features required to track authorship and evidence down to a specific paragraph (article). Anyone who has written or revised policy can understand that the logistical hurdles to securing that content, versioning and promoting it are simply beyond the scope of the modern word processor.

Articles

Articles are the basic unit of content. Articles will have a unique number or sequence and will contain a cohesive singular message. Articles titles are displayed in the table of contents for a Policy.

Sections

Sections are a collection of related articles. Section 1.0 will contain articles 1.1, 1.2, etc.

Policy

A policy is a collection of Articles and optionally Sections.

Publishing

Articles and sections will not be displayed in the viewer unless they are published. Look for the blue version information on the article editor to determine whether an article has been published or not.

We hope you enjoy your 30 day free trial and we look forward to adding exciting new features to help you manage all aspects of policy creation and compliance.

Policy Is Not Linear

2019-03-04T00:00:00+00:00

Let’s face it, not much has changed in the world of policy writing. The medium has changed (handwritten, typewriters, computers), but the linear nature of writing has remained. Most policy shares common elements including a numbering system with an established hierarchy and a title or header to help the reader know the topic. Organizations crafting policy face a similar set of problems once they embark on the writing process. Let’s explore the pain points in more detail.

Formatting

The blog you are reading contains formatting. It has a designated font, size, spacing, and text decorations (bold, underline, italic, bullets etc.). Traditional word processors give users unnecessary freedoms during the writing process. This leads to final documents that are inconsistent. This in turn increases the administrative overhead required to regain that consistency. It’s difficult to automate and means that policy can only be released once it has passed a rigorous manual process.

Structure

The presence of structure is mostly an illusion when crafting policy in a traditional document format. I’m defining structure as how articles and sections interrelate throughout a policy document. Forcing an appropriate structure results in a proper table of contents. It also enforces order. Policy is frequently a hierarchy of ideas and is paramount to help ensure that all bases have been covered.

The linear nature of storing policy is the single greatest impediment to harnessing its true potential. Why?

We are unable to “point” to a specific idea in a data driven way.
We are resigned to build table of contents based on H1, H2 header types rather than on unique indexes.
We are unable to update versions for each article, but are instead forced to version an entire policy.
We are unable to grant permissions on an article basis which effectively allows any user to edit any part of a policy.

By redefining our definition of policy as a collection of related, ordered, articles, we resolve these problems. We also receive the added benefit of compartmentalizing the permissions structure ensuring that only those qualified to write specific areas of policy are able to do so.

Collaboration

Prior to services like Google Docs, collaboration meant writing your part of a policy and then saving it to a file-share or emailing it to a project manager or clerical staff member. Google Docs improved upon this by allowing multiple users the ability to edit the same document in real time. Its usefulness is somewhat limited at scale because performance degrades noticeably with large documents and many shared authors. Collaboration in this manner further degrades accountability back to the specific author. Changes to policy with a verifiable approval chain is critical to satisfying the baseline requirements for policies tied to control matrixes.

Learn More

PolicyCo will change the way you write, edit, and manage policy. Further we plan to enhance procedures and revolutionize evidence gathering for compliance activities.