Skip to main content
TruSecure — Home
PLATFORM · POLICY ASSISTANT

Policy that stays in sync with what's actually operating.

The classic audit finding is not a missing policy — it is a policy that describes a system nobody runs anymore. Documents get written for an audit, filed, and silently drift away from operational reality until the next audit notices.

TruSecure's Policy Assistant keeps policy in sync with what is actually operating. AI drafts or updates policy language from the control library and the relevant framework citations; a named human reviews and approves; the approved policy is versioned and linked back to the specific controls it documents. When a control changes, the policy that documents it shows as stale — before an auditor does the arithmetic for you.

How it works

  1. Draft

    AI drafts policy language from the control library — the operational definitions your systems are actually measured against — with the framework citations attached.

  2. Review

    A named person edits, approves or rejects. Drafts never publish themselves; the approval is recorded with identity and timestamp.

  3. Version and link

    The approved policy is versioned and linked to the controls it documents, so "show me the policy for this control" is a lookup, not a search.

  4. Attest on cycle

    Review dates are tracked per policy. When a linked control changes, the policy is flagged for re-review instead of drifting quietly out of date.

What a policy record looks like

policy-record.jsonJSONSample data
{
  "policy": "Access control policy",
  "version": "4.1",
  "documents": ["AC-2 · Accounts",
    "AC-5 · Least privilege"],
  "cites": ["NIS2 21(2)(a)",
    "ISO A.5.1"],
  "drafted": "AI · from control library",
  "approved": "named policy owner",
  "next review": "2027-02-01"
}

Which regulations it maps to

NIS2 names policies on the security of network and information systems as the first risk-management measure (Art. 21(2)(a)); ISO 27001 opens its Annex A with the policy requirement (A.5.1). Both expect the document to match the practice — which is exactly the property the control link enforces.

Policy already lives in SharePoint or a policy-management tool? Document-repository and policy-management connectors pull version history and approval records, so the assistant works on your real documents, not a parallel library.

Book a demoSee the policy assistant in action