02 — Capability · BC-120.30
Policy Framework
Keep a single hierarchy of policies, standards and procedures with named owners, review dates and one place to find the current version, so people follow what is actually in force.
- Policy Management
- Policy Lifecycle
- Governance Documents
In scope
- Policy hierarchy and document types
- Policy authoring approval and publication
- Periodic review and retirement of policies
Out of scope
- Compliance training and attestation against policies (see BC-140)
- IT-specific standards and controls (see BC-710)
Decomposes into · 4
- BC-120.30.10Policy Hierarchy DesignDefine what counts as a policy, a standard and a procedure, how they relate and who may approve each.
- BC-120.30.20Policy Authoring & ApprovalDraft, consult on and approve policies through a route that matches their reach and risk.
- BC-120.30.30Policy Publication & AccessPublish current policies where the people they bind can find them and retire superseded versions.
- BC-120.30.40Policy Review CycleReview each policy on its schedule or when the law or the business changes, and record the outcome even when nothing changes.