Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.15.01Policy and proceduresITSP.10.171Planning

Official Requirement

A. Develop, document, and disseminate to organizational personnel or roles, policies and procedures needed to satisfy the security requirements for the protection of specified information. B. Review and update policies and procedures [Assignment: organization-defined frequency].

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

Your organization must create, document, and distribute security policies and procedures that cover all relevant topics, assign roles and responsibilities, and demonstrate management commitment. These policies must be shared with all relevant personnel and reviewed and updated at a regular defined frequency.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon
View in Map →

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

Truvo CyberTruvo CyberBuilt and maintained by Truvo Cyber
Authors·Connect with us
Updated: Mar 22, 2026Reviewed: Mar 22, 2026v1.0.0
Share this tool

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

Security policy and procedure management

Implementation steps

  1. Create documented security and privacy policies and procedures addressing all applicable security requirements
  2. Secure management approval and formal sign-off on all policies to demonstrate organizational commitment
  3. Distribute policies to all relevant personnel and obtain signed acknowledgements of receipt and understanding
  4. Review and update policies at the defined frequency and whenever significant organizational or regulatory changes occur

Tools / systems

Evidence artifacts

Evidence frequency: Annual policy review and update (or at defined frequency); per-event updates for regulatory changes