Policies capture the rules your organization commits to, and attestations are the record that each person has read and accepted them. In ISO Mate you draft a policy, publish it under version control, assign it to user groups, and track who has signed. Policies, user groups, and audit logs live in the sidebar Compliance group, and each person signs from My Compliance in their profile menu.
Create a policy
- Go to Compliance > Policies and click Create. When AI creation is enabled for your account, the button also offers Create with AI.
- Enter the policy title.
- Optionally choose a category and set the attestation threshold, the percentage of assigned users who must sign for the policy to count as compliant.
- Write the policy body in the rich text editor.
- Click Create Policy. The policy is saved in draft status as version 1.
Version control
Policies carry full version control. A draft can be edited freely. Once you publish it, the version is locked. To make further changes, open the policy and use Create Draft to start a new draft version. Publishing the new draft supersedes the previous version, and the full history stays visible in the version list. A published policy can also be archived when it is retired.
Assign policies to user groups
- Create user groups under Compliance > User Groups, for example “Engineering” or “Finance”. An “All Staff” group is created automatically by the framework templates, with the relevant policies already assigned.
- Open the policy, and in the Assigned Groups panel click Assign Groups.
- Pick one or more user groups and optionally set a due date.
- Save the assignment.
Members of the assigned groups are asked to attest to the policy once it is published.
Publish and the attestation cycle
Publishing does more than change the status. When you publish a draft with the Publish button, ISO Mate creates an attestation record for every user in every assigned user group, bound to the newly published version, and those users see the policy in their queue right away.
If the policy is already published and you publish a new draft version, attestation records are regenerated against the new version, so every assigned user must acknowledge the updated content. Attestations for the previous version are retained for the audit trail.
How people attest
- Open the profile menu at the top right and choose My Compliance to see the policies awaiting a signature.
- Click Review & Sign on a policy.
- Read the policy content and confirm.
- The attestation is recorded against the current published version with the user, date, and timestamp.
Track completion
Open a published policy to monitor progress. The Attestation Progress panel shows the completion percentage, the number signed out of the total, the users still pending, and a progress bar. Each policy carries an attestation threshold (default 90%), and the policy counts as compliant once the percentage of assigned users who have signed the current version meets or exceeds it. The status updates automatically as attestations are recorded.
Attestation records are scoped to the account that owns the policy. Users who belong to more than one account only see attestations for policies in their active account.
Next steps
Policies are generated for you when you scaffold a framework in Setting Up Compliance Frameworks, and you can link a policy to the controls that enforce it in Managing Controls and Evidence.
Ready to roll out policies and collect sign-off? Start your free 14-day trial.