Under “Policies”, you manage the controlled documents of your ISMS: the information security policy, policies, directives and regulations. Each document is versioned and approved through its own approval workflow with signatures. This guide is aimed at ISMS managers and at the people responsible for the documents.

Before you start

  • Policies are created and edited by people with the corresponding permissions for “Policies”; by default, these are the ISMS managers. By default, all employees may read them.
  • The functional roles that are to approve (e.g. top management) must have members. How to do this is described in Defining functional roles and permissions.
  • Other documents such as manuals, minutes or contracts belong in Documents & evidence.
  1. Create and add a version

    With responsible person, review interval and approval workflow.

  2. Submit for review

    After that, the version can no longer be changed.

  3. ApproversSign

    Step by step; with the last signature, the version is valid.

  4. MembersAcknowledge

    Only if acknowledgement is required, for each new valid version.

Rejected

The version goes back with a justification; the previous signatures are void.

Review due

30 days before the interval expires: confirm unchanged or create a new version.

The path of a policy

A policy is created with an approval workflow, and the version is submitted for review. The approvers sign step by step; with the last signature, the version is valid. If acknowledgement is required, all members with access confirm it. If it is rejected, the version goes back with a justification. 30 days before the review interval expires, the task “Review document” is created.

Creating a policy

  1. Open Policies. As long as there is no information security policy, you start with Add information security policy; otherwise, click Create document or Create another document.
  2. Step 1 – Document: enter the title and purpose, choose the responsible person and define every how many months (1 to 120) the document is reviewed. Title, responsible person, review interval and the Approval workflow are required: functional roles per step. All approvers in the same step sign in any order; the next step only follows afterwards.
  3. Step 2 – First version: upload a file (PDF or Word as .docx, at most 50 MB), provide a link or choose Add later. Then choose New – have it approved in Varmo or Already approved (existing ISMS).
  4. For a new version, open the document and click Submit for review. After that, the version can no longer be changed.

Approving

The approvers open the version and choose Sign or Approve. With the last signature, the version becomes valid and replaces the previous one. With Reject, the version goes back with a justification; the previous signatures are void.

The four-eyes principle applies without exception: whoever created or submitted a version does not sign it, not even as Tenant Admin. If an approver step has no one apart from you, you cannot submit; the page then shows Change approval workflow or Assign functional roles. More on this in Managing approvals with the four-eyes principle.

Adopting existing approvals

If your organisation continues an existing ISMS (Settings › Organisation) and you have already adopted a policy outside Varmo, you do not need to have it reviewed again. For the first version, choose Already approved (existing ISMS) or, for the draft of the first version, Adopt existing approval. Record who approved it, on which date and from when the version applies, and upload the evidence as a PDF (signed document or meeting minutes). The approvers then confirm the adoption in Varmo – four-eyes principle; only then does the version apply. Every further version goes through the approval workflow.

The version applies immediately and remains marked as adopted. The next version goes through the approval workflow again.

Acknowledgement

For documents such as the information security policy or an acceptable use policy, you can require everyone to read them:

  1. Open the document.
  2. In the Acknowledgement card, tick Require acknowledgement by all members.
  3. All members with access to the policies receive a task and confirm with Acknowledge. You see the status (“… of … have acknowledged version …”) in the same card.

For each new valid version, everyone is asked again. Acknowledgement only reaches people with access to Varmo. For employees without access, you need other evidence, such as a training session with an attendance list.

What happens next

  • When a version is submitted, the approvers receive a task in My tasks; with several steps, one after the other.
  • After a rejection, the person who created the draft receives the task to revise it and submit it again.
  • 30 days before the review interval expires, the responsible person receives the task “Review document”. If the document remains valid unchanged, a member of one of the document's approver roles confirms with Confirm review without changes; otherwise, the responsible person creates a New version.

Archiving

Policies with submitted or approved versions cannot be deleted, so that evidence is kept. Instead, archive them with a justification; people with the permission to delete policies may do so. The document then no longer applies: no reviews, signatures or acknowledgements. Versions, signatures and confirmations are kept. Archived documents are listed under Archived and can be brought back with Restore. Archiving is not possible while an approval is in progress.

Frequently asked questions

Is there a standard approval workflow?

No. Each document receives its own approval workflow when it is created. You can change it later on the document with Change approval workflow.

How do I use a policy as evidence for a requirement?

On the requirement, in the “Evidence” section, link the valid policy with Link policy…. See Setting applicability and approving the SoA.