Kind + title + body
Markdown in the record. Not a PDF graveyard disconnected from the register.
Platform · Policies
Write the policy next to the control.
Policies are versioned Markdown in the same workspace as the controls they support. No copilot publishes them. A human drafts; approval is a later gate.
Why it exists
A wiki page with no version is not a policy program.
Examiners ask which text was in force, who wrote it, and whether it maps to a control. ReadyComply keeps kind, title, and body as a versioned draft — organization-wide or bound to a system.
In the workspace
What you can draft today.
Versioned drafts
Version number increments as drafts are created. You can see which text is current.
Org or system scope
Company-wide information security policy, or a system-specific access standard.
Human gate
Status starts as draft. Approval is a later product gate — not a model clicking publish.
What is next
Copilots draft. They do not own the policy.
Grounded policy help is on the list: suggest text from the control statement, not from the open internet. Until that ships, write it yourself. The version history is already the point.
Also in ReadyComply
Policies sit on top of controls and work.
Controls
Scope SOC 2, ISO 27001, HIPAA, and GDPR families to each system. Track status, owner, and why something is out of scope.
Evidence
File what you have against a control. Manual upload or a read-only connector.
Remediation
Turn gaps into owned work with a due date. Who closed what is part of the record.
Draft the first policy in the same place as the control.
Sign in. Open a system. Write what you actually do — not what a template claims you do.
Sign in