Policy Management

The Policy Management module in Venvera provides a centralised library for your organisation's compliance policies. You can auto-generate framework-specific policies, create custom policies with document uploads, and manage each policy through a formal lifecycle. This article covers the regulatory context, documents every feature, and explains the full policy lifecycle workflow.

Regulatory Context

Multiple regulatory frameworks require formal, documented policies:

Policy Dashboard

Navigate to Policies in the sidebar. The page shows a header with action buttons, summary stat cards, framework filter tabs, and the policy list.

Summary Stat Cards

Framework Filter Tabs

A row of filter tabs at the top lets you filter policies by framework: All, DORA, NIS2, ISO 27001, GDPR, EU AI Act, SOC 2, NIST CSF, Cyber Essentials, UAE IA, NDPA, CMMC, PCI DSS, HIPAA. Each tab shows the count of policies in that framework. A coloured dot beside each framework name provides quick visual identification.

Auto-Generating Policies

Venvera can auto-generate a standard set of compliance policies for each supported framework. This saves significant effort compared to writing each policy from scratch.

What Policies Are Generated

Each framework generates a tailored set of policies. Examples include:

• DORA: ICT Security Policy, ICT Risk Management Policy, Incident Response Policy, Business Continuity Policy, ICT Third-Party Risk Policy, ICT Change Management Policy, and more.
• NIS2: Risk Analysis and Information Security Policy, Incident Handling Policy, Supply Chain Security Policy, Cryptography Policy, and more.
• ISO 27001: ISMS Policy, Access Control Policy, Asset Management Policy, Information Classification Policy, and more.
• GDPR: Data Protection Policy, Privacy Notice, Data Breach Response Policy, Data Retention Policy, Data Subject Rights Policy, and more.
• PCI DSS: Information Security Policy, Access Control Policy, Network Security Policy, Data Protection Policy, Vulnerability Management Policy, Incident Response Policy, Physical Security Policy, Third-Party Risk Policy, and more.
• HIPAA: Security Policy, Access Control and Authentication Policy, Contingency and Disaster Recovery Policy, Physical Safeguards Policy, Audit and Monitoring Policy, Breach Notification Policy, Business Associate Management Policy, and more.
• SOC 2, NIST CSF, CMMC, Cyber Essentials, UAE IA, NDPA: Each generates a tailored set of 8–12 policies aligned with the framework's requirements.

Creating a Custom Policy

For policies not covered by the auto-generation templates, create a custom policy:

Policy Lifecycle

Every policy follows a four-stage lifecycle. Status transitions are performed via buttons that appear when you expand a policy card:

Document Management

Each policy can have multiple documents attached. Expand a policy card (click the eye/chevron icon) to see the Documents section:

• Upload: Click the Upload button to add a new document. Supported types: PDF, DOC, DOCX, XLSX, XLS, CSV, TXT, PNG, JPEG. Max size: 25 MB per file.
• Download: Click the download icon next to any document to retrieve it.
• Delete: Click the trash icon to remove a document (with confirmation).

Each document entry shows the filename, file size, file type icon (PDF, DOCX, XLSX, CSV, IMG, FILE), and the upload date. For auto-generated policies, a "Download .docx" button in the action bar downloads the generated policy content as a formatted Word document.

Supported File Types

AI Policy Review

Venvera can analyse any policy against your organisation's tracked framework controls using AI (Claude or ChatGPT). The review identifies missing controls, vague sections, and provides an overall coverage score. See the full AI Policy Review guide for detailed documentation.

Starting a Review

Click the sparkles icon (✨) on any policy row — this expands the policy and immediately starts the AI analysis. You can also expand a policy first, then click the purple "Review with AI" button in the expanded action bar.

Review Results

The AI review panel appears below the status buttons with a purple border, showing:

• Coverage percentage — colour-coded bar (green ≥80%, amber ≥50%, red <50%)
• Summary — plain-language assessment of the policy's compliance posture
• Missing Controls — controls that should be addressed but aren't, with expandable suggested language
• Controls Covered — green badges for controls the policy already addresses
• Suggested Improvements — existing sections that need stronger or more specific language

Implementing AI Suggestions as a New Draft

When the review identifies missing controls or improvements, a purple "Implement Suggestions in New Draft" button appears next to the summary. Clicking it:

1. Sends the original policy and all review findings to the AI provider
2. The AI produces a complete improved version — preserving the original structure while adding missing sections and strengthening weak ones
3. The improved policy is saved as a new draft titled "[Original Title] (AI-Improved Draft)"
4. A DOCX file automatically downloads for offline review
5. The policy list refreshes to show the new draft

Policy Card Details

Each policy in the list displays:

• Title — the policy name
• Framework badge — colour-coded label (DORA/NIS2/ISO 27001/GDPR)
• Status badge — Draft, In Review, Approved, or Archived
• Version number — shown as "v1", "v2", etc.
• Article references — relevant regulatory articles (up to 4 shown, with "+N more" for additional)
• Last updated date — when the policy was last modified
• Created by — the user who created the policy

The action icons on each policy row are (left to right): ✨ AI Review (sparkles — triggers AI analysis), 👁 Expand (shows details, documents, and status buttons), ⬇ Download (DOCX download, for generated policies), and 🗑 Delete. Expanding a policy reveals the full content preview (first 3000 characters in monospace font), document attachments, status transition buttons, and AI review results if a review has been run.

Best Practices

• Generate first, customise second: Use the auto-generate feature for each applicable framework, then review and tailor each policy to your organisation before approving.
• Upload supporting documents: Attach procedures, process diagrams, and evidence documents to the relevant policy for a complete audit package.
• Track versions: Each policy carries a version number. When a policy needs significant revision, the version increments on update.
• Archive, do not delete: When a policy is superseded, use the Archive status instead of deleting it. This preserves the audit trail showing which policies were in effect at any given time.
• Approval dates matter: Regulators expect policies to be formally approved. The approval timestamp on each policy provides evidence of management oversight as required by DORA Art. 9(4) and NIS2 Art. 20.

Step-by-Step: Full Policy Lifecycle