> For the complete documentation index, see [llms.txt](https://docs.sprinto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sprinto.com/policies/how-it-works.md). # How it Works Learn how policies are created, approved, mapped, and maintained in Sprinto to support continuous compliance. The Policies module enables you to create, manage, and maintain documentation aligned with your compliance frameworks. Whether you use Sprinto templates, upload custom documents, or sync from Confluence, all policies follow a structured lifecycle designed to ensure audit readiness and team-wide visibility. *** ### **Step 1: Add a policy, procedure, or document** You can create a new item in the Policies module in one of the following ways:
MethodDescription
Use a Sprinto templateSelect from pre-built policies aligned with frameworks like ISO 27001, SOC 2, and GDPR.
Use the built-in editorDraft policies or procedures from scratch using Sprinto’s rich text editor.
Upload a fileUpload a non-editable document in PDF format.
Select from libraryChoose framework-required documents (e.g. ISMS scope) from Sprinto’s content library.
Sync from Confluence or SharePointImport policies directly using document labels and metadata.
Once added, each policy appears in **Draft** status and must be reviewed before it becomes active. *** ### **Step 2: Review and approve the policy** After drafting or uploading a policy: 1. Assign an **Approver** to the document. 2. (Optional) Assign **Reviewers**, who can comment but cannot approve. 3. Click **Send for approval**. Once the policy is approved, it moves from **Pending approval** to **Active**. Only active policies can be shared with employees for acknowledgement. *** ### **Step 3: Map security controls** For each approved policy, you can map it to specific controls required by your framework. * Use **AI-assisted mapping** to generate control suggestions. * Or manually select controls from the control drawer. * Once mapped, the policy acts as evidence for the selected controls. Policies created from templates often come with predefined control mappings. *** ### **Step 4: Monitor policy status and history** Every policy includes version history and metadata: * Track changes, approvals, and reviewer comments across versions. * View the status of each policy (Draft, Pending, Active, or Disabled). * Download documents or update branding from the three-dot menu. You can also use the **Monitoring tab** to set up compliance checks tied to policy acknowledgements, reviews, or evidence submissions. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.sprinto.com/policies/how-it-works.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.