Policy management that works at the statement level

Frequently asked questions

What is policy management software?

Policy management software is the system of record for an organization's internal rules: creation, review, approval, distribution, acknowledgement, and retirement. Traditional tools treat a policy as a single document. Dictiva treats it as a set of atomic statements, so each individual requirement carries its own version history, owner, approval state, and regulatory mappings.

What is the difference between policy management software and document management software?

Document management software stores and versions files. Policy management software governs the requirements inside them. A document system can tell you that version 4 of the security policy was approved in March; it cannot tell you which of the 40 requirements in that document changed, who owns each one, which ISO 27001 controls they satisfy, or whether employees understood them. Dictiva answers those questions because the statement (not the file) is the unit of record.

Is there a free policy management software option?

Yes. Dictiva's Community plan is free forever with no credit card required, and includes statement-first authoring, version history, approval workflows, and full-text search. Paid plans add multi-framework regulatory mapping at scale, AI comprehension verification, advanced maturity analytics, and higher usage limits.

What should enterprises look for in policy and procedure management software?

Five things separate enterprise-grade tools from document repositories: granular version control below the document level, configurable multi-stage approval routing, distribution with verified acknowledgement, mapping of a single requirement to multiple compliance frameworks without duplication, and an immutable audit trail. Add role-based access control and multi-tenant data isolation if you operate across business units or regions.

How does policy management software handle IT and security policies?

IT and security policies change faster than HR or finance policies and map to more external frameworks, so document-level versioning breaks down quickly. Decomposing them into statements lets you update a single control (a password rotation interval, an encryption standard) without reissuing and re-acknowledging the entire policy, and shows you instantly every framework that control satisfies.

How does compliance policy management software support audits?

Auditors ask requirement-level questions: show me the control, its approval history, and evidence it was communicated. Because Dictiva maps each statement to SOC 2, ISO 27001, GDPR, HIPAA, and 40+ other frameworks, audit prep becomes a filtered query rather than a document hunt: one statement can satisfy controls across several frameworks with no copy-paste duplication.

What is the difference between policy management and procedure management software?

A policy states what must be true; a procedure states how someone carries it out. Most policy and procedure management software stores both as documents and leaves the relationship implicit. Dictiva models them as separate linked objects: a statement carries the requirement, and a procedure carries the ordered steps that satisfy it. That link is what makes the pair auditable: you can show which procedure implements a given control, and which controls are left without any documented procedure at all.

How do you prove employees actually read and accepted a policy?

Distribution is not evidence. Dictiva issues acknowledgement requests scoped to a domain, an assembly, or an individual statement, records who responded and when, and keeps that record on an immutable audit trail. Because acknowledgement is scoped per statement rather than per document, amending one requirement re-triggers sign-off only for the people that requirement affects: you do not reissue a 40-page manual to the whole company to change a password rotation interval.

Does policy management software handle UK and multi-jurisdiction requirements?

Yes. Dictiva's regulatory library covers UK GDPR and the Data Protection Act 2018 alongside EU GDPR, the EU AI Act, ISO 27001, SOC 2, HIPAA, and 40+ other frameworks, with the relationships between them modelled explicitly: UK GDPR is recorded as transposing EU GDPR into domestic law, so a statement satisfying one is visibly linked to the other rather than duplicated. The interface is available in eight languages for organizations operating across regions.

Is policy management software worth it for a small business?

It is, once you have more policies than one person can hold in their head, usually well before the first SOC 2 or ISO 27001 audit. The cost that hurts a small team is not the tool, it is reconstructing approval history and acknowledgement evidence under audit deadline. Dictiva's Community plan is free forever with no credit card, so the practical question is whether to start capturing that history now or reconstruct it later.

What does policy lifecycle management software track?

The lifecycle runs draft, review, approval, publication, distribution, acknowledgement, periodic review, and retirement. Most tools track it at the document level, giving a 40-page manual a single status field. Dictiva tracks it per statement, so one document can legitimately hold requirements in four different states at once (two approved, one in review, one retired) and the dashboard surfaces which individual requirements are overdue rather than declaring the whole manual current. Ownership, next review date, and approval history attach to the requirement, not the file.

How much does policy management software cost, and how should you evaluate options?

Pricing is typically per user per month with an implementation fee, but the sticker price is rarely the deciding cost: migrating existing policies and the internal time to keep the tool current usually exceed it. Three questions separate options faster than any feature matrix: can one requirement map to several frameworks without being duplicated, is approval history queryable or merely archived, and can you evidence acknowledgement at the requirement level rather than the document level. Dictiva's Community plan is free forever, so all three can be tested against your own policies before any commitment.

Is policy management software different for healthcare, banking, or government?

The workflow is the same; the mapping burden is not. Regulated sectors carry overlapping obligations (HIPAA and HITRUST in healthcare; SOX, PCI DSS, and regulator-specific guidance layered over ISO 27001 in banking) and a single internal control often satisfies several at once. Document-based tools force one copy per framework, so every amendment becomes a multi-document edit and the copies drift. A statement-first model keeps one requirement mapped to many frameworks. Government adds records-retention and public-disclosure duties, both of which need an immutable audit trail rather than versioned files.

Can policy management software help write policies, not just store them?

Storage-first tools begin with an uploaded document, which means the writing happened elsewhere and arrives unstructured. Dictiva begins with the statement: you author individual requirements, tag each with its taxonomy and framework mappings, and assemble them into published policies. The order matters: a requirement written as a discrete, testable statement can be owned, mapped, and acknowledged, while the same requirement buried mid-paragraph cannot. AI drafting assists at the statement level, and comprehension checks verify that readers understood a requirement rather than confirming they opened a file.

Can you use SharePoint for policy management?

You can store policies in SharePoint, and many organizations do. What it does not provide is requirement-level structure: it versions the file, not the 40 rules inside it, so it cannot tell you which control changed, who owns it, which frameworks it satisfies, or who must re-acknowledge after an amendment. The common pattern is SharePoint as the document library plus spreadsheets tracking control mappings and sign-off, and the spreadsheets are where the audit trail breaks. Dictiva replaces that spreadsheet layer rather than the file store.