Jekyll2019-12-12T22:16:14+00:00https://policyco.io/Product marketing template for Jekyll.{"name"=>nil, "email"=>nil, "twitter"=>nil}2019-10-11T17:00:00+00:002019-10-11T17:00:00+00:00https://policyco.io/weekly%20update/2019/10/11/policyco-weekly-update---10-11-2019<p>It has been another busy week here at PolicyCo.</p> <p>This week the team has been focused on making updates to the dashboard, article editor, and some work under the hood.  Here’s a quick look at what’s gotten some attention this week.</p> <ul> <li>First Time User Flow Updates</li> <li>Article Editor UI Updates</li> <li>Dashboard UI Updates</li> <li>Updated site to Angular 8.2.9</li> <li>HelpHero Product Tour (to deploy on Monday)</li> <li>Article Editor Tabbing Behavior - Now tabbing affects bullets, numbered lists, and paragraphs.  (to deploy on Monday)</li> <li>Miscellaneous Bug Fixes</li> </ul> <p>As noted above, there were a couple of features that were wrapped up at the end of the week that will be deployed on Monday morning.  Some other items on next week’s list include more dashboard enhancements and a better onboarding flow for new users.</p> <p>If there is anything that you think we’re missing, or should move up in our queue, feel free to reach out to us.   If you have any questions about how PolicyCo can help your policy process, we’re always happy to have that conversation.</p>{"name"=>nil, "email"=>nil, "twitter"=>nil}

It has been another busy week here at PolicyCo.

2019-10-04T12:00:00+00:002019-10-04T12:00:00+00:00https://policyco.io/2019/10/04/policyco-weekly-update---first-edition<p>Welcome to the first edition of our PolicyCo Weekly Update.</p> <p>We are excited about the progress that we’ve been making over the past several months at PolicyCo.  Since the August 1 launch of the first iteration of the app, the team has been working on new features, enhancements, bug fixes and improvements.  Moving forward, this is where we will be sharing a quick overview of our latest releases and upcoming plans for the future of PolicyCo.</p> <p>This week’s progress includes: </p> <ul> <li>Re-launched our website on Tuesday, October 1</li> <li>Deployed an updated version of the user dashboard</li> <li>Added organizational whitelisting so that new users with your company’s email address can join your organization without an invitation</li> <li>Added the ability to copy the settings from one policy to all other policies within an organization</li> <li>Updated and refined several UX/UI components</li> </ul> <p>If there is anything that you think we’re missing, or should move up in our queue, feel free to reach out to us.   If you have any questions about how PolicyCo can help your policy process, we’re always happy to have that conversation.</p>{"name"=>nil, "email"=>nil, "twitter"=>nil}

Welcome to the first edition of our PolicyCo Weekly Update.

2019-08-12T14:00:00+00:002019-08-12T14:00:00+00:00https://policyco.io/marketing/2019/08/12/policy-structure<p>One of the more challenging aspects of creating policies for an organization is deciding on which categories to begin with. Maintaining 40-60 policies can overcomplicate an already complicated process. I found an article from February 2014 by David Lineman called <a href="https://informationshield.com/how-to-structure-information-security-policies/" target="_blank">How to Structure Information Security Policies</a>, that resonated with me. In this article, he offers advice on how which categories to start out with.</p> <p>As I reviewed these with our CISO, we found that David’s approach did a good job of providing needed structure to our diverse (scattered) list of policies. I’d encourage you to read his article and I’ve also provided the list of policies below:</p> <ol> <li>IT Risk Management Policy (Risk Assessment)</li> <li>Security Program Policy (Policy, Planning, Personnel)</li> <li>Asset Management Policy (Inventory, Acceptable Use, Protection)</li> <li>Information Management Policy (Collection, Classification, Storage, Disposal)</li> <li>Third Party Security Policy (Assessment, Contracts)</li> <li>Personnel Security Policy (Screening, training, termination)</li> <li>Access Control Policy (Systems, Accounts, Passwords)</li> <li>Network Security  Policy  (Firewalls, Structure, Wireless)</li> <li>Physical Security Policy(Visitors, IT Systems)</li> <li>Operations Management (Configuration, Change Control, Malware)</li> <li>Application Security Policy (Development, Testing)</li> <li>Security Incident Management Policy (Reporting, Response, Investigation)</li> <li>IT Business Continuity Policy    (backup, Business Continuity)</li> <li>Security Monitoring Policy (Logging, Audit, Monitoring)</li> <li>Customer Privacy Policy</li> <li>Employee Data Privacy Policy</li> </ol> <p>Another key takeaway from the article stresses the importance of keeping policy statements separate from procedure or standards statements. This is another firmly held belief at PolicyCo. Policies are all about intention in a generic sense while procedures and standards are provided for specificity.</p> <blockquote> <p><em>Policy - Files are backed up nightly.</em></p> <p><em>Procedure - A backup script runs on server A in /bin/backup.sh. It backs up database servers x, y and z. Joe Smith is responsible for its proper nightly operations and alerts go to noc@policyco.io if it fails.</em></p> </blockquote> <p>The breakdown of Policy documents listed above is also convenient for separation of duties ensuring the appropriate technical teams have access to the policies that affect their daily duties, particularly as it relates to technical vs management teams.</p> <p>As with most things, there are many ways to organize information. I hope this has helped you in your decision making process. Special thanks to Mr. Lineman and informationshield.com.</p>{"name"=>nil, "email"=>nil, "twitter"=>nil}

One of the more challenging aspects of creating policies for an organization is deciding on which categories to begin with. Maintaining 40-60 policies can overcomplicate an already complicated process. I found an article from February 2014 by David Lineman called How to Structure Information Security Policies, that resonated with me. In this article, he offers advice on how which categories to start out with.

2019-08-01T14:00:00+00:002019-08-01T14:00:00+00:00https://policyco.io/marketing/2019/08/01/policyco-is-live<p>After 9 months of planning and development, the first phase of PolicyCo is in production. All customers get a 30 day free trial. Baseline features include:</p> <ul> <li>Unlimited users per organization</li> <li>$50/mo first policy $5/mo per additional policy</li> <li>Create unlimited articles within each policy</li> <li>Assign project manager / owner / billing / author / viewer / billing roles</li> <li>Set font and size from project manager role</li> <li>Draft and publish authority / history</li> <li>Subscription management</li> <li>User invitation and management</li> <li>Create / delete sections</li> <li>Create / delete articles</li> <li>View policies online</li> <li>Download policies as pdf</li> </ul> <p>In the coming weeks we will be adding:</p> <ul> <li>Attachments</li> <li>Evidence</li> <li>Sockets for live co-editing</li> <li>Bulk assignments</li> <li>More robust invitation flow</li> <li>.doc / docx downloads</li> </ul> <p>Are we missing something critical to your needs? Let us know at support@policyco.io.</p>{"name"=>nil, "email"=>nil, "twitter"=>nil}

After 9 months of planning and development, the first phase of PolicyCo is in production. All customers get a 30 day free trial. Baseline features include:

2019-03-04T00:00:00+00:002019-03-04T00:00:00+00:00https://policyco.io/marketing/2019/03/04/policy-is-not-linear<p>Let’s face it, not much has changed in the world of policy writing. The medium has changed (handwritten, typewriters, computers), but the linear nature of writing has remained. Most policy shares common elements including a numbering system with an established hierarchy and a title or header to help the reader know the topic. Organizations crafting policy face a similar set of problems once they embark on the writing process. Let’s explore the pain points in more detail.</p> <h2 id="formatting">Formatting</h2> <p>The blog you are reading contains formatting. It has a designated font, size, spacing, and text decorations (bold, underline, italic, bullets etc.). Traditional word processors give users unnecessary freedoms during the writing process. This leads to final documents that are inconsistent. This in turn increases the administrative overhead required to regain that consistency. It’s difficult to automate and means that policy can only be released once it has passed a rigorous manual process.</p> <h2 id="structure">Structure</h2> <p>The presence of structure is mostly an illusion when crafting policy in a traditional document format. I’m defining structure as how articles and sections interrelate throughout a policy document. Forcing an appropriate structure results in a proper table of contents. It also enforces order. Policy is frequently a hierarchy of ideas and is paramount to help ensure that all bases have been covered.</p> <p>The linear nature of storing policy is the single greatest impediment to harnessing its true potential. Why?</p> <ol> <li>We are unable to “point” to a specific idea in a data driven way.</li> <li>We are resigned to build table of contents based on H1, H2 header types rather than on unique indexes.</li> <li>We are unable to update versions for each article, but are instead forced to version an entire policy.</li> <li>We are unable to grant permissions on an article basis which effectively allows any user to edit any part of a policy.</li> </ol> <p>By redefining our definition of policy as a collection of related, ordered, articles, we resolve these problems. We also receive the added benefit of compartmentalizing the permissions structure ensuring that only those qualified to write specific areas of policy are able to do so.</p> <h2 id="collaboration">Collaboration</h2> <p>Prior to services like Google Docs, collaboration meant writing your part of a policy and then saving it to a file-share or emailing it to a project manager or clerical staff member. Google Docs improved upon this by allowing multiple users the ability to edit the same document in real time. Its usefulness is somewhat limited at scale because performance degrades noticeably with large documents and many shared authors.  Collaboration in this manner further degrades accountability back to the specific author. Changes to policy with a verifiable approval chain is critical to satisfying the baseline requirements for policies tied to control matrixes.</p> <h2 id="learn-more">Learn More</h2> <p>PolicyCo will change the way you write, edit, and manage policy. Further we plan to enhance procedures and revolutionize evidence gathering for compliance activities.</p>{"name"=>nil, "email"=>nil, "twitter"=>nil}

Let’s face it, not much has changed in the world of policy writing. The medium has changed (handwritten, typewriters, computers), but the linear nature of writing has remained. Most policy shares common elements including a numbering system with an established hierarchy and a title or header to help the reader know the topic. Organizations crafting policy face a similar set of problems once they embark on the writing process. Let’s explore the pain points in more detail.