On this page0
Guide
Keep policies up to date and download the Statement of Applicability (SoA)
See which of your written policies are approved, waiting or due for another look, get them approved again, and download the list an auditor asks for first: every requirement, whether it applies to you, and why not when it does not.
Before you start
- A role that can manage compliance. In the built-in set, administrators have that permission. The “security_analyst” role has it too; no group carries it, so an administrator gives it to a person by hand, as Roles, groups and permissions shows. Someone who can only view reports can open both windows and read them.
- A second person to approve. Whoever wrote or last changed a policy cannot approve that version. Only an administrator is excepted.
- At least one policy in the register. Adding one from the library, writing its text and getting people to sign it are in Get policies signed.
Check your policies
Step 1: Read the Policies card
Go to Security & ComplianceCompliance Hub and click the “Program” tab. The “Policies” card shows how many policies you track, and under the number a line such as “6 approved · 1 awaiting approval · 2 overdue for review”.
- Approved: in force, and counted as evidence for the controls it covers.
- Awaiting approval: a draft. A draft is not evidence, and nobody is asked to sign it.
- Overdue for review: the date set for the next look at this policy has passed.
With no policies at all, the card reads “None in the register” in amber.
Step 2: Open the policy register
Click “Open policy register”. The window is titled “Policy register”. Its columns are “Policy”, “Version”, “Owner”, “Status”, “Controls”, “Last approved” and “Signed”.
“Status” is “Draft” or “Approved”. “Last approved” shows the date in green, and in amber once it is more than a year old. “Controls” is the number of controls the policy covers; hover over it to see which. At zero the tooltip reads “Maps to no control — it will not verify anything”.
Step 3: Approve a draft
A draft row has an “Approve” button. The policy’s owner clicks it, or another person who can manage compliance. A message says the policy is approved and how many controls it now counts toward.
If the button is greyed out, hover over it for the reason: either you are not the owner and cannot manage compliance, or you wrote this version yourself, so someone else must approve it.
Step 4: Approve again after a year
When “Last approved” turns amber, the row shows a “Re-approve” button. Read the policy, check it still says what your company does, and click it. The date is set to today and a new review date is set, no more than a year ahead.
Step 5: Change a policy
Click the pencil button on the row. You can change “Policy name”, “Version”, “Owner” (the email address of the person who approves it), “Controls this policy covers (optional)”, “Link (Notion / Drive / SharePoint)”, “Policy text” and “Description”. Click “Save”.
On an approved policy the form warns that changing the name, version, text, link or mapped controls returns it to draft until it is approved again. After you save, a message confirms it is a draft again. Until someone approves it (step 3), it does not count as evidence.“Add policy”, above the list, adds a policy you type in yourself. It is added as a draft.
Step 6: Remove a policy you no longer use
Click the bin button (its tooltip reads “Delete this policy”). The window that opens names the policy and, when people sign it, says how many have. Click “Delete policy” to confirm.
This cannot be undone. The policy stops counting as evidence. Signatures already given stay on record, but their list can no longer be downloaded from here, and adding the policy again makes everyone sign again.
Download the Statement of Applicability (SoA)
Step 7: Pick the framework, then open the SoA
The statement is made for one framework at a time. In the switcher under the page title, click the framework you want. Then, on the “Program” tab, the “Statement of Applicability” card shows that framework’s name. Click “Open SoA”.
Step 8: Read it
Three counts sit at the top: how many controls are “applicable”, how many are “N/A”, and how many of the applicable ones are “implemented”. The table below has the columns “Control”, “Clause” (where the requirement sits in the framework’s own text), “Applicable”, “Status” and “Justification”.
You do not type into this window. It is drawn from the state of your controls at the moment you open it, and the line at the foot gives the time it was generated.
Step 9: Download it
Click “CSV” for a spreadsheet file. It carries the same rows, plus each control’s domain and owner.
Click “Sealed PDF” for the copy to file with an auditor. Zonitix saves a PDF of the statement as it stands now to the evidence vault, sealed so a later change to the file can be detected, and downloads it to you. This button is shown only to people who can manage compliance.
Step 10: Change what the statement says
Because the statement is drawn from your controls, you change it by changing them, in one of two places:
- On the “Program” tab, under “Scope — your environment”, answer the questions under “Scope your controls” and click “Apply scope”. Controls that do not apply are marked N/A with the reason “Out of scope (scoping)”. To give one of them a more specific reason, open it from the table on “Overview” and choose “Edit N/A reason…”.
- For one control, open it from the table on “Overview”, click “More” at the foot of the panel and choose “Waive (mark N/A)…”. Type the reason in “Justification (required)” and click “Mark N/A”. This takes the control out of the readiness score in every framework it belongs to, and the reason is printed on every report.
Open the SoA again to see the change.
Step 11: Optional: see how controls held up over time
At the top of the SoA window, switch from “Point-in-time” to “Over period (Type II)”. Type II is the kind of audit that asks whether a control stayed in place over a period, not just on one day. Zonitix records each control’s state once a day, and this view looks back over the last 90 days: “held throughout” counts the controls that were passing in every daily record, and “had gaps” those that dropped out at least once.
On a new hub it reads “No period history yet”. The daily records build up by themselves; look again after a few days.
What you should see
The “Policies” card shows only approved policies, in green, with nothing awaiting approval and nothing overdue for review. In the register, every row reads “Approved” with a green date.
You hold a file named for the framework and today’s date, ending “.csv” or “-sealed.pdf”, and every control marked “No” under “Applicable” has a reason beside it.
If something goes wrong
- "Separation of duties: you drafted this version, so someone else must approve it."
- Ask the policy’s owner, or another person who can manage compliance, to click Approve. An administrator can approve their own draft.
- "Only the policy owner or a compliance manager can approve."
- Your email address is not the one in the policy’s "Owner" field and your role cannot manage compliance. Ask the owner to approve, or ask someone who manages compliance to put your address in "Owner".
- The card counts a policy as overdue for review, but its row has no "Re-approve" button
- The button appears once the last approval is more than a year old. A policy added from the library can carry an earlier review date. Saving a change to its text or version returns it to draft, and approving it then sets a new review date. Check the signing settings on the policy first: people who sign it are asked again when its text changes.
- An approved policy went back to Draft
- Someone changed its name, version, text, link or mapped controls. Have it approved again (step 3).
- A control marked "No" under Applicable reads "N/A — justification missing"
- It was marked N/A without a written reason. Open the control from the table on Overview, choose "Edit N/A reason…" and write why it does not apply. Auditors expect a reason for every exclusion. A control excluded by "Apply scope" reads "Out of scope (scoping)" instead; the same action replaces that with a specific reason.
- There is no "Sealed PDF" button
- It is shown only to people who can manage compliance. The "CSV" button is there for everyone who can open the hub.
Still stuck? See When something goes wrong, or Contact Zonitix support.