Policy management

The policy library

Open Compliance from the sidebar and select the Policies tab. You see every policy in the tenant with its status (Draft, Under Review, Published, Archived), owner, last review date, and the frameworks it covers.

Filter by status, category, or framework. Click any policy to open the editor, which shows the current version alongside metadata, version history, and acknowledgment tracking.

AI-drafted policies

Click Generate with AI, name the policy type (Access Control, Data Classification, Incident Response, Acceptable Use, Vendor Management, etc.), and describe the frameworks it should satisfy. Radius360 drafts a full policy using the conventions of those frameworks.

1. 1
   Name the policy type. The AI uses it, along with the frameworks you mention, to decide structure, terminology, and which controls the policy must address.
2. 2
   Add requirements and context. A prompt box for frameworks and anything specific to the client (industry, data handled, regulatory overlays, cultural quirks like "we do not allow personal devices").
3. 3
   Review the draft. Radius360 generates the policy in seconds. Read it. Edit inline. The draft follows the structure auditors expect: Purpose, Scope, Policy Statements, Roles and Responsibilities, Enforcement, Review Cycle.
4. 4
   Save. The policy enters the library as a Draft. You can keep iterating or move it to Under Review and then Published.

Importing existing policies

If the client already has policies they want to keep, use Upload policy. Upload a PDF, Word, Markdown, or text file, set its status (Draft or Published), and save. The policy lives in the library alongside the AI-drafted and manually-written ones.

To bring in a batch of documents at once, use the Intake tab. Intake reads and classifies each document and proposes what to create; nothing is written until you approve it.

Version history

Every change is tracked. Open a policy and select the Version History tab to see every saved revision with its timestamp and author. Click any version to view its content. Nothing in the history is deleted.

Publishing and acknowledgments

Move a policy to Published to publish it. Published policies are visible to everyone in the tenant who has access. You can require explicit acknowledgment from a group of users (all staff, just admins, just new hires, etc.) and Radius360 tracks who has and has not acknowledged.

The Outstanding Acknowledgments dashboard shows who still needs to read a policy and when their grace period expires. Export this list for audit evidence or for sending reminders.

Framework mapping

Every policy is mapped to the framework controls it addresses. Radius360 does this automatically during AI drafting and suggests mappings during import. You can edit the mapping manually from the policy editor.

When a policy is mapped to a control, that control is considered "policy-covered" in the framework assessment. You still need evidence that the policy is being followed, but the written policy itself is one of the satisfied requirements.

Evidence-aware policies

For tenants with connected deep integrations, Radius360 can draft policies that reflect the actual configuration of your environment rather than a generic template.

Example: when drafting an Access Control policy for a tenant with Okta connected, the AI reads your actual MFA enforcement settings, password policy, and privileged-access workflow, and writes the policy to match. If the enforced configuration drifts from what the policy says later, Radius360 flags the drift as a risk.