workflow
Policy Lifecycle Management
Run one policy through its full lifecycle, anchored to a Policy item in the policy library — created at authoring for a net-new policy, enriched in place on each refresh cycle (never duplicated). In scope: authoring and control/authority linkage, stakeholder review, formal approval, publication and workforce attestation, acknowledgement tracking, disposition, and scheduled alignment refresh. Consumes read-only upstream: the enterprise risk assessment (Risk items), control design (Control items), and obligation mapping — this workflow neither produces nor edits them. Produces four named deliverables: the published policy version, a frozen workforce attestation completion record, a section-by-section alignment verdict, and a single approval-ready policy package. Out of scope: enterprise risk assessment, control design, and obligation mapping. The approved policy package is handed off to the Regulatory Compliance Attestation Cycle, which runs the recurring regulatory attestation; the acknowledgement campaign launched here is the one-time publication attestation and is explicitly flagged in the handoff as not-to-be-repeated downstream.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-10-04T21:48:26Z (791ff2dd3a45)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- domain
- grc
- department
- compliance-legal
- lineOfDefense
- monitor
Details
- teams
- compliance-legal
- executive
- domains
- grc
- standards
- iso-27001
- cobit-2019
- sourceTemplateId
- workflow-library:grc-policy-lifecycle-management
- releaseId
- sha256:17250f06b3c843e503970eb29c1cf53a117342cbd272c0ae6e3ce8709f55db5f
- canonicalUrl
- https://evidenceflows.com/workflows/all/?w=grc-policy-lifecycle-management
- capabilities
- mappingStatus
- mapped
- lineOfDefense
- monitor
- controls
- UC-GOV-14
- UC-TRAIN-04
- UC-CONFIG-09
- UC-GOV-29
- UC-GOV-30
- UC-GOV-31
- UC-GOV-32
- UC-GOV-34
- UC-GOV-35
- UC-GOV-36
- UC-HR-07
- roleIntegrity
- activityCount
- 0
- ermPhases
- lineRoles
- serviceModes
- warnings
Source
No record-specific source URL is provided.
Download workflow template · Release: sha256:17250f06b3c843e503970eb29c1cf53a117342cbd272c0ae6e3ce8709f55db5f
Connections
- Policy Lifecycle Management oversees UC-TRAIN-04 — Communicate control responsibilities and reporting channels
- Policy Lifecycle Management oversees UC-GOV-36 — Maintain communications security and cryptography policies
- Policy Lifecycle Management oversees UC-GOV-29 — Maintain secure acquisition, development, and maintenance policies
- Policy Lifecycle Management oversees UC-GOV-30 — Maintain asset, media, and physical protection policies
- Policy Lifecycle Management oversees UC-GOV-32 — Maintain security awareness and cyber-hygiene policies
- Policy Lifecycle Management oversees UC-GOV-14 — Establish and maintain approved security policies and procedures
- Policy Lifecycle Management oversees UC-HR-07 — Secure remote working arrangements
- Policy Lifecycle Management oversees UC-CONFIG-09 — Document configuration management policy, plan, and procedures
- Policy Lifecycle Management oversees UC-GOV-31 — Maintain access control, identity, and personnel security policies
- Policy Lifecycle Management oversees UC-GOV-35 — Maintain incident response policy and procedures
- Policy Lifecycle Management oversees UC-GOV-34 — Maintain business continuity and contingency planning policy