Policy Categories

Estimated reading: 2 minutes

Policy Categories are logical groupings of related policies that organize and standardize governance, security, risk, and compliance requirements across an organization. The following are the default policy categories defined for use.

Category	What It Covers
AI Governance	Governance of AI systems including ethical use, accountability, risk management, and regulatory compliance.
AI Monitoring & Agent Governance	Monitoring, auditing, and control of AI agents and automated decision-making systems.
Banking & Financial	Security and compliance of financial transactions, payment systems, and fraud prevention mechanisms.
Business Continuity	Planning and processes to ensure operations continue during disruptions, disasters, or system failures.
Cloud & Infrastructure	Security, configuration, and management of cloud platforms and IT infrastructure environments.
Compliance & Regulatory Management	Adherence to legal, regulatory, and industry standards through policies, audits, and reporting.
Data Security & Privacy	Protection of personally identifiable information (PII), sensitive personal data, and proprietary organizational data.
Development & Application Security	Secure software development practices including coding standards, testing, and vulnerability management.
Encryption & Cryptography	Use of encryption techniques and key management to protect data confidentiality and integrity.
Enterprise Identifiers	Management of unique identifiers such as user IDs, system IDs, and resource naming conventions.
Governance & Operations	Oversight of organizational processes, policy management, and IT governance frameworks.
Identity & Access Management	Control of user identities, authentication, authorization, and access permissions across systems.
Incident & Monitoring	Detection, tracking, and response to security incidents and system activities.
Information Security & Access	Protection of information systems and enforcement of access control policies.
Risk & Vulnerability	Identification, assessment, and mitigation of risks and system vulnerabilities.
Secrets & Credentials	Secure storage, management, and rotation of sensitive credentials like passwords, tokens, and keys.
Security Operations & Observability	Continuous monitoring, logging, and analysis of systems to maintain visibility and security posture.
Third-Party & Vendor Risk Management	Assessment and management of risks associated with vendors, partners, and external suppliers.
Threat Detection & Response	Identification of threats and execution of response actions to contain and remediate them.
Uncategorized	Policies that do not fit into predefined categories and require further classification.

Policy Categories

Policy Categories

CONTENTS