Information security policy management that tests every promise against practice, every night
Every policy promise tested against practice each night, and signed by the CISO.
See one case, screen by screen ↓Information security policy management that treats each policy as a set of promises and tests them. Six agents split every policy into its “shall” statements, test each one against the systems that prove it every night, check coverage against ISO 27001 Annex A and SOC 2, keep the exceptions register and run acceptance campaigns. The CISO signs every version and every exception.
How to choose AI solutions for back-office and enterprise work →
Updated
Every ISO 27001, SOC 2, NIS2 or DORA programme starts with a set of written security policies, and every audit asks the same question: does the company do what its policies say? Today the policies are Word files on a portal. Each owner is asked once a year to review theirs, and most change the date and the version number. The mapping to Annex A and the SOC 2 criteria lives in a spreadsheet that was rebuilt by hand when the 2022 edition renumbered the controls, and still misses some of the new ones.
Practice drifts away from the prose without anyone seeing it: quarterly access reviews done twice a year, leavers disabled days late, service accounts that cannot use the MFA the policy promises for “all privileged access”. Exceptions are approved by email and expire unnoticed. Employees “accept” the policy with a click, and their questions go to a mailbox nobody owns. The company learns its policy over-promised when the auditor samples practice — or when an attacker does.
Estimated split for a set of 24 security policies at a large company, by hand and with the solution.
Six specialist agents draft the wording, test every “shall” against real systems each night, check coverage and exceptions, and run acceptance; the CISO signs.
Kestrel & Vane Group — about 40,000 people in 30 countries, ISO 27001:2022 certified with a surveillance audit on 18 November — keeps 24 security policies with 583 “shall” statements. On Thursday 15 October the nightly test finds a new red thread in the Access Control Policy. Here is what happens next, screen by screen, in the working solution.
Rachel's Today screen opens on what the agents did overnight: 583 statements checked, 41 that differ from practice — 3 for the first time — 4 decisions for her, and 86.5% of people who have accepted Acceptable Use v3.0. The decisions are ordered by risk: 37 service accounts that break the MFA promise, the Cryptography Policy review 31 days overdue, an expired exception at Bremen Line 4, and four Annex A controls with no statement.
Change watcher: “Incident Response §3.2 promises notice ‘within 72 hours’; NIS2 needs an early warning within 24 hours. I opened a review with Sofia Reyes.”
She types the question in plain words. The Reality agent answers: §5.3 promises MFA for all privileged access, and last night 37 of 2,214 privileged accounts had none. All 37 are service accounts in six integrations, and the safeguards for an exception hold for 34. Each figure carries a numbered source she can click to read, and the answer ends with one action: open the finding.
Every answer cites the record it came from; any action waits for a person to confirm it.
The Access Control Policy v4.2 reads like the document it is, with every “shall” underlined. A thread runs from each statement to its procedure, owner, Annex A or SOC 2 control and the live evidence: green where practice matches, red where it differs, dashed where no system can show it yet. Of 46 statements, 41 match, 3 differ and 2 are untested. The red thread on §5.3 carries the finding: 2,177 of 2,214 privileged accounts use MFA; 37 service accounts do not.
§5.3 · Differs · A.8.5, A.8.2, CC6.1 · procedure ACS-02 §3.2 · tested Thu 02:10 · confidence 0.97
The finding shows the agent's plan as it ran: read the statement and what it means, read the identity export of 14 Oct, 23:00, match the sign-in method of every account, reconcile the count with the privileged access vault, and report. 1,612 personal admin accounts use MFA; 565 service accounts use workload identity; 37 sign in with a password only. Anyone can press “Test again”.
“Confidence 0.97 — complete export, reconciled to the vault. Not 1.0 because 4 accounts were created after 23:00 and will be read tonight.”
The Exception keeper tests the safeguards the Access Control Standard ACS-02 allows instead of MFA: credentials held in the vault 37 of 37, sign-in limited to the four data-centre address ranges 37 of 37, password rotated in the last 30 days 34 of 37. The Drafter costs both ways out. A: move the six integrations to workload identity — 6 weeks, about 30 engineering days, owner Daniel Osei. B: record exception EX-2026-031 today, rotate the 3 overdue passwords by 22 Oct, review in 90 days, with A as the long-term fix. The 37 accounts are listed by integration: ERP batch jobs 11, label printing at plants 8, payroll export 6, backup agents 5, monitoring 4, bank file transfer 3.
Asked to “rotate the 3 overdue passwords now”, the Exception keeper answers: “I do not change systems” — and drafts the request to the identity engineering lead.
Rachel chooses option B. The decision asks for a review date (13 Jan 2027), an exception owner (Daniel Osei), the condition — rotate the 3 overdue passwords by 22 Oct 2026 — and a reason code: EX-C2 · Compensating controls verified. She ticks “I, Rachel Kim (CISO), sign this decision” and signs. A rejection would need a note.
Agents change nothing until she signs.
EX-2026-031 joins the exceptions register: 15 open, every one approved by the CISO, none longer than 180 days. The Exception keeper will re-test the three safeguards 22 Oct and before the review date. The same register shows the one that slipped: EX-2025-019, the Bremen Line 4 workstation on an unsupported operating system, expired on 12 Oct. The agent asked Ben Carter whether the machine is still needed, and offers to re-test its safeguards before Rachel renews or closes it.
An expired exception turns the statement red again on the policy; it is never extended without a new decision.
The Drafter redlines v4.3: “All privileged access by people shall use phishing-resistant multi-factor authentication. Non-interactive service accounts shall hold vaulted credentials rotated at least every 30 days, or an approved exception.” A new §8.6 makes the rotation a promise that can be tested nightly. Daniel accepts it — “keep phishing-resistant; it matches our token rollout”. The Coverage reviewer confirms A.8.5, A.8.2, A.5.17 and CC6.1 are still covered. The Reality agent's truth test: true today for people, 1,612 of 1,612; true for service accounts once the exception's condition is met on 22 Oct. Only then can Rachel sign.
“No wording change for §6.1 and §7.2. They are right; practice must catch up.”
Every statement is mapped to the 93 Annex A controls, the 33 SOC 2 criteria and NIS2 Article 21. 89 of 93 controls have a statement. The four gaps — 5.7, 8.10, 8.11 and 8.12 — are all among the 11 controls new in 2022: the library was first mapped to the 2013 edition. Click A.5.7, threat intelligence: no policy says anything that meets it, and the Coverage reviewer suggests Sofia Reyes as its owner. One click asks the Drafter for statements.
The Acceptable Use campaign reaches Jonas on the shared terminal in German: six rules that apply to him as a warehouse supervisor, each in plain words with its clause, to read and accept by 31 October. He asks whether he can read work email on his phone; the Attestation agent answers from §4.2 — only in the company mail app — and cites it. A question the policy does not answer goes to its owner, with a reply within one working day.
64 of 312 questions were about §4.2, so the Drafter proposed a clearer wording for v3.1.
The same policy set, seen by the five people who carry it — what their year looked like, and what it looks like now.
Six specialist agents draft the wording, test every “shall” against real systems each night, check coverage and exceptions, and run acceptance; the CISO signs.
Writes and updates policy wording, proposes options for a broken promise and clarifications for unclear clauses, and redlines every change with its cited reason and a plain-language score.
Turns each “shall” into a test against the system that would prove it — identity directory, privileged access vault, IT service desk, HR, endpoint, cloud configuration, vulnerability scanner — runs it every night and records the rows it read and its confidence.
Maps every statement and every draft to the 93 Annex A controls, the 33 SOC 2 criteria and NIS2 Article 21, finds gaps and the controls that rest on a statement that differs.
Keeps the exceptions register, tests the compensating controls an exception relies on, and re-tests them before expiry.
Runs read-and-accept campaigns by role and site, shows people only the rules that apply to them in their language, answers their questions from the policy and clusters the questions by clause.
Reads law and standard updates, new systems in the asset inventory and incidents, names the exact statements they affect and opens a review with the owner.
Signs; policy owners review their drafts. The agents propose; a named person decides.
On every screen — the briefing, the policy, the finding, the draft, the campaign — ask a question or say what to do. Answers cite the record; actions wait for you to confirm.
Why is Access Control red?
Because §5.3 promises MFA for all privileged access, and last night 37 of 2,214 privileged accounts had none. All 37 are service accounts in six integrations; the safeguards for an exception hold for 34.
Which integrations would break if we enforce MFA today?
All six: ERP batch jobs (11 accounts), label printing at plants (8), payroll export (6), backup agents (5), monitoring (4), bank file transfer (3). None can answer a second factor; they need workload identity.
Rotate the 3 overdue passwords now
I do not change systems. I have drafted the rotation request to Priyanka Nair, Identity Engineering Lead, for svc-bankfx-02, svc-payroll-exp-04 and svc-label-mty-02.
What will the auditor find on 18 November?
If nothing changes: the overdue Cryptography review; access reviews and leavers, which auditors sample first — AC §6.1 and §7.2 differ; and 4 Annex A controls with no statement.
13 screens from the working solution, on its sample data. Pick one to see it large.
What Kestrel & Vane decided: frameworks, rules, connections and reminders. Every change asks for a reason and is logged.
| Setting | Default | Choose from |
|---|---|---|
| Nightly practice test | 02:00 | The time the Reality agent tests every statement |
| Confidence floor | 0.85 | Below it, a person checks the result before it counts as a match |
| Longest exception | 180 days | The Exception keeper cannot propose longer |
| Review cycle | 12 months, or on significant change | Owners reminded 60, 30 and 7 days before; CISO told at 14 days overdue |
| Tolerance · leavers (AC §7.2) | 0 late accounts | Set per statement |
| Tolerance · patching (VM §3.2) | 2% of findings, up to 7 days late | Set per statement |
| Frameworks | ISO/IEC 27001:2022 Annex A · SOC 2 · NIS2 Article 21(2) | Annex A (93 controls) · SOC 2 (33 common criteria) · NIS2 Art. 21(2) (10 measures) · DORA Article 9, for financial entities |
| Acceptance reminders | 7, 3 and 1 day before; managers after the due date | Annual campaigns, in 11 languages |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (a 2026 ISO 27001 checklist quoting vendor figures — external gap analysis EUR 5–15k; Directive (EU) 2022/2555 (NIS2) Art. 20, 21 and 34 — fines for essential entities of at least EUR 10M or 2% of worldwide turnover, whichever is higher; ISO/IEC 27001:2022 Annex A — 93 controls, 11 new in 2022). Kestrel & Vane Group and the people named on this page are fictional — characters and sample data in the working solution.
Information security policy management that treats each policy as a set of promises and tests them. Six agents split every policy into its “shall” statements, test each one against the systems that prove it every night, check coverage against ISO 27001 Annex A and SOC 2, keep the exceptions register and run acceptance campaigns. The CISO signs every version and every exception.
The Reality agent turns each statement into a test against a system of record — the identity directory, privileged access vault, IT service desk, HR system, endpoint management, cloud configuration or vulnerability scanner — and runs it every night. It shows its plan, the rows it read and its confidence; below 0.85 a person checks the result. Statements no system can show go to their owner for evidence.
It re-runs the coverage check every night. The Coverage reviewer maps every statement and every new draft to the 93 Annex A controls, the 33 SOC 2 criteria and NIS2 Article 21, names the controls with no statement and the ones resting on a statement that differs, and asks the Drafter for wording to close a gap.
An owner requests an exception with its compensating controls; the Exception keeper tests those controls and routes it to the CISO, who approves with a reason code, a review date and any condition. No exception runs longer than 180 days, safeguards are re-tested before expiry, and an expired exception turns the statement red again.
The Attestation agent asks only the people a policy applies to, by role and site, in their language. They read the rules that apply to them and can ask questions; the agent answers from the policy with the clause cited, or sends the question to the owner. Questions that cluster on one clause become a proposed clarification.
No. The agents read systems and never change them, never publish, never grant an exception and never approve their own text. A request to change a system becomes a drafted request for the person who owns it.
Yes. Policy owners review their drafts, the Coverage reviewer and Reality agent must pass a new wording, and only the CISO approves a version or an exception, with a reason code; a rejection needs a note. Every action by people and agents is on a hash-chained audit trail.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your policy set, standards and the systems that prove practice — and it goes live once every quality gate has passed. We will walk you through it on your own policies first.
Exceptions found before the auditor finds them, and one evidence set for both audits.
1-min demoNIS2 ComplianceEvery EU entity scoped, registered and evidenced per country, with the board signing off.
1-min demoCyber Incident ReportingEvery regulator clock met, from one cited set of facts the committee signed.
1-min demoWe'll run Security Policy Management on your own policy set and the systems that prove it.