Document Library

The Document Library (also called the Policy Generator) is the in-app home for the written policies CMMC and NIST SP 800-171 expect you to maintain. Instead of wrestling with Word templates on a shared drive, you generate a policy from a professionally drafted starting point, edit it in a rich document editor, move it through a review and approval workflow, and publish it — the one step that turns a finished policy into evidence linked to the practices it satisfies.

Every policy lives as a single, stable document with a complete revision history: who changed what, when, why, and whether the change was material. That history is your audit trail, and publishing keeps your compliance posture, SSP, and assessment evidence pointed at the currently-approved version.

Key concepts

The policy catalog

The library ships with a curated catalog: a ready-to-generate policy for each CMMC control family — the fourteen families that organize the NIST SP 800-171 practices (Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity). Additional families that align to newer NIST guidance — Planning, System and Services Acquisition, and Supply Chain Risk Management — are available as well.

Each catalog entry appears as a row in your required-document checklist with its current status, whether a published version exists, and when the policy is next due for review. You can also add your own custom policies beyond the catalog, or upload an existing document you already maintain instead of generating one.

Lifecycle status

A policy moves through a lifecycle. The status tells you exactly where the document stands and who can act on it next.

Merge fields

Generated policies come pre-filled with your organization's details through merge fields — placeholders the system resolves for you at generation time, including your organization name, the effective date, your CMMC level, your named security contacts and affirming official, and the list of your in-scope systems. You never hunt-and-replace "Company Name" by hand.

Fill-in placeholders

Beyond the auto-filled merge fields, templates carry two kinds of placeholders you complete while editing. Each shows as a colored [bracket] until you answer it, and the checklist counts how many remain.

CMMC clause highlighting

Passages that answer a specific NIST SP 800-171 practice are highlighted and carry a hover tooltip naming the practice they address. This shows — to you and to an assessor reading the exported document — exactly which requirement each clause satisfies, so nothing is left implicit.

Using the Document Library

The main page shows your required-document checklist. Opening a policy takes you into the editor workspace, with its version history alongside.

Generate a policy from a template

Edit the document

Submit for review

Approve

An approver reviews the in-review version and approves it, which records the approver and a timestamp and moves the policy to Approved. Approving does not yet make the policy count as evidence — that happens at publish.

Publish

Publishing is the step that makes a policy count. It is the only action that surfaces the document as evidence linked to the practices it covers.

Track revision history

Every policy keeps a full change log. Each entry records the version label, its status, the editor and approver, the timestamps, the change summary, and whether the change was flagged material — with the rendered PDF available for published versions. Use it to see how a policy evolved and to demonstrate a controlled document process to an assessor.

Export to PDF or Word

Any policy can be exported as a PDF or a Word (DOCX) document — the same content, formatting, and CMMC clause highlighting in a portable file you can share, print, or hand to an auditor.

Permissions

Access is governed by three permissions in the role matrix.

VIEW_POLICIES is held by every non-platform role, including Assessor (read-only). MANAGE_POLICIES is held by Org Admin, Org User, MSP Super, and MSP Admin. APPROVE_POLICIES — the gate on publishing evidence — is held by Org Admin, MSP Super, and MSP Admin, not Org User (who can write and submit, but not approve) or Assessor.

How it works

Extra detail on how the library behaves — product behavior, not internals.

One stable document, many versions

Each policy is a single stable document per organization. Editing, submitting, approving, and publishing all operate on versions of that one document, so its identity — and the evidence links pointing at it — stay put across its entire history. A new round of edits creates a new working version on top of the published one; the published copy stays live until the new version is itself published.

Generation fills in what it can

When you generate a policy, the merge fields pull from your live organization data — your legal or display name, your named security and affirming contacts, your highest CMMC level across assessments, and your in-scope system names (rendered as readable sentence text). Where a value isn't set yet, the draft uses a sensible fallback and leaves a placeholder you can complete.

Publishing links across your whole assessment

On publish, the policy attaches to every objective in its control family — matched by the family the policy belongs to — across all of your assessments at once. That's why a single published policy can satisfy the documentation expectation for many practices in one step, and why re-publishing cleanly refreshes those links rather than accumulating stale ones.

Related features