Policy Ownership Assignment (POL-001-R002) - POL-001

Requirement Details & Guidance

POL-001-R002 · POL-001

Why This Requirement Exists

To ensure every policy has clear accountability for its accuracy, approval, maintenance, communication, and periodic review.

Implementation Guidance

Assign a named business or security owner to each policy; document responsibilities for drafting, approval, review, publication, and retirement; maintain ownership records in the policy repository; establish escalation for overdue reviews.

Practical Application & Audit Readiness

POL-001-R002 · Field Guidance

Business Examples

Common Audit Findings

Common Mistakes

Best Practices & Ownership

POL-001 · Recommended Approach

Recommended Practices

Typical Owner

Cross-Mapped Regulatory Frameworks

Harmonized Control Mappings

FRAMEWORK CODE	FRAMEWORK NAME & DETAILS	FAMILY / CATEGORY	VERSION	ACTION
COBIT2019	COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO01 – Managed I&T Management Framework > APO01.09 – Define and communicate policies and procedures.	COBIT Governance Framework	v2019	View →
DORA	Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(4)(a) – Information security policy protecting availability, authenticity, integrity and confidentiality	EU Regulation	vCurrent	View →
GDPR	General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 24(1) – Responsibility of the controller; Article 24(2) – Data protection policies	EU Regulation	vCurrent	View →
HIPAA	Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.316(a)(1) Policies and procedures documentation	US Law	vCurrent	View →
IRDAI	IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.5-III – Ownership and interpretation; §1.6-3 – Chief Information Security Officer (CISO)	India Guideline	vLatest	View →
ISO22301	ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 5.2.1 – Establishing the business continuity policy	ISO Standard	v2019	View →
ISO27001	ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 5.2 – Policy 5.3 – Organizational roles, responsibilities and authorities	ISO Standard	v2022	View →
ISO27002	ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.1 – Policies for information security	ISO Standard	v2022	View →
NIS2	NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(a) – Policies on risk analysis and information system security	EU Directive	vCurrent	View →
NIST-CSF	NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.PO – Policy \| GV.PO-01 – Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced	NIST Framework	v2	View →
NIST80053	NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.12 – PLANNING; PL-1 – POLICY AND PROCEDURES	NIST Control Catalog	vRev. 5	View →
NPCI-ISR	NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Governance Controls; Governance and Oversight Structure – Establishing clear policies	India Standard	vLatest	View →
PCI-DSS	PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.1.1 – An overall information security policy is:	PCI Standard	v4	View →
RBI-CSF	RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §3 – Need for a Board approved Cyber-security Policy; Circular §4 – Cyber Security Policy to be distinct from the broader IT/IS Security Policy	India Regulation	vLatest	View →
SEBI-CSCRF	SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.3 GV.PO: Policy	India Regulation	vLatest	View →
SOC2	SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.	AICPA Audit Framework	vLatest	View →

Parent Domain Context

Governance Domain Baseline

Domain Name:

Policy & Document Management (POL)

Purpose:

To create, maintain, and manage the lifecycle of security and compliance policies, standards, and procedures.

Scope:

Enterprise

View

Parent Control Context

Control Baseline

Control Name:

Policy Management (POL-001)

Summary:

Establishes a governed lifecycle for creating, approving, maintaining, and retiring security, privacy, and compliance policies, standards, and procedures.

Business Description:

Define, maintain, and manage the lifecycle of security, privacy, and compliance policies, standards, and procedures.

View