GRCLibrary.ai

Document type

Policies

18 documents. Governing intent and mandatory direction the rest of the corpus implements.

Documents, 18

Every document of this type

Each with its area and its purpose; a document that states no purpose gets a line naming its type and area. A title in a corpus area opens the document's page, which holds the record and, where the document has them, its outline, frameworks, and related documents; a title in the Library area is a library specification with no page and opens its source on GitHub. The full text of every document is read on GitHub.

  • AI Compliance PolicyAIThis policy establishes the organization's obligations and commitments for AI regulatory compliance. It defines the classification of AI systems, the governance structures accountable for compliance, the obligations that apply to the organization as an AI deployer and, where relevant, as a provider, and the obligations that arise under applicable national and international AI governance frameworks.
  • BASC Information Security PolicyComplianceThis policy establishes the framework for managing and protecting the organization's information assets and supporting infrastructure in alignment with the applicable Business Alliance for Secure Commerce (BASC) International Security Standard (6.0.2 or 6.0.3, per the organization's role in the cargo chain). It ensures that the confidentiality, integrity, and availability of data are maintained across all BASC-certified operations.
  • Compliance, Audit, and CAPA Management PolicyComplianceThis policy defines the governance framework for compliance assurance, internal audit, and corrective and preventive action (CAPA) across the organization.
  • Legal and Regulatory Compliance PolicyComplianceThis policy establishes the framework for identifying, interpreting, tracking, implementing, and reporting compliance with legal and regulatory obligations across all jurisdictions where the organization operates.
  • Secure Development and Engineering PolicyDev securityThis policy establishes mandatory requirements for secure software development, engineering practices, and lifecycle management across all applications, systems, and code repositories.
  • Digital Twin and Simulation Governance PolicyGovernanceThis policy establishes the governance requirements for the development, deployment, and operation of digital twins, simulation environments, and virtual replicas of physical systems, processes, or organizations. It ensures that these technologies are governed with appropriate oversight of data use, AI integration, security, and operational risk.
  • Exception and Risk Acceptance Management PolicyGovernanceThis policy defines the organization-wide process for managing security, risk, compliance, and operational exceptions. It consolidates the former Exception Process, Risk Acceptance Memo Procedure, Temporary Waiver Procedure, and Exception Tracking Log into one cohesive governance artefact.
  • Privacy and Data Governance PolicyPrivacyThis policy defines principles, governance structure, and control framework for managing personal data and organizational information assets across all jurisdictions. It consolidates Privacy Policy, Data Governance Policy, Data Quality Policy, and Records Management Policy into a unified global standard. It supports the organization's compliance with applicable data protection laws, upholds data accuracy and integrity, and governs ethical use of information including AI training datasets.
  • Business Continuity and Disaster Recovery PolicyResilienceThis policy establishes a reusable governance baseline for business continuity, disaster recovery, crisis coordination, and recovery assurance. It defines policy intent for maintaining critical services, recovering data and systems, coordinating disruptive events, and preserving evidence for risk, compliance, audit, and improvement activities.
  • Enterprise Governance and Risk Management PolicyRiskThis policy establishes the enterprise governance and risk management framework, principles, roles, and control requirements that guide consistent identification, assessment, treatment, monitoring, and reporting of risk across the organization. It is aligned with ISO 31000:2018 Clauses 5 and 6, COBIT 2019 APO12, CSA CCM v4.1 GRC domain, NIST SP 800-39, ISO/IEC 23894:2023 for AI risk, and the NIST AI RMF 1.0. The policy integrates risk, compliance, privacy, security, resilience, ethics, and sustainability across business, technology, data, and AI systems.
  • Acceptable Use PolicySecurityThis policy defines acceptable use of information systems, devices, networks, and data by all authorized personnel. It establishes the boundaries of permitted activity, prohibited behaviours, and personal use expectations. All personnel must acknowledge this policy annually.
  • Acceptance Into Service PolicySecurityThis policy establishes a standardized framework for evaluating, approving, and transitioning new or changed systems, services, and AI solutions into operational production environments. It ensures that all deliverables meet readiness, compliance, security, and risk requirements before formal acceptance.
  • Bring Your Own Device (BYOD) PolicySecurityThis policy governs the use of personally owned devices, including smartphones, tablets, and laptops, to access corporate data and applications. It defines the technical controls applied to personal devices, the obligations of the device owner, and the boundaries of the organization's access to the device.
  • Encryption and Key Management PolicySecurityDefines mandatory encryption and cryptographic key management requirements. Ensures that confidentiality, integrity, and availability are protected through consistent encryption controls for data at rest, in transit, and in use.
  • Identity and Access Management PolicySecurityTo ensure that all users, human, service, and machine, are uniquely identified, appropriately authenticated, and authorized according to business need, while maintaining compliance with information security, privacy, and regulatory obligations.
  • Information Security PolicySecurityTo ensure that information security is systematically managed, risks are mitigated through proportionate controls, and the organization maintains compliance with ISO/IEC 27001:2022, ISO/IEC 27002:2022, NIST CSF 2.0, COBIT 2019, and CSA CCM v4.1.
  • Network Communications Security PolicySecurityThis policy defines the technical and procedural controls for securing organizational networks across on-premise, cloud, and hybrid environments.
  • Workforce Network Monitoring PolicySecurityThis policy governs the monitoring of workforce network activity: the collection, analysis, and use of telemetry, traffic signals, and presence data generated by personnel and their devices on organization systems and networks. It exists to keep monitoring lawful, proportionate, transparent, and confined to legitimate security and compliance aims, and to place explicit limits on how monitoring signals may be used.

With script, All Documents, filtered to Policies, lists these 18 documents, and the area chips holding any of them, and its text filter, narrow them further.