PolicyReadiness
ProductPricingPartnersSign upSign in

What is new in PolicyReadiness

The changes that you can see, newest first. You have an idea for the next one? Write to us.

21 October 2026

  • No lockout by someone else. Wrong passwords now lock an email address only on the network they came from. Someone who knows your email can no longer lock you out: you sign in from your own network as usual. Many wrong passwords from many networks still lock the address for 15 minutes.
  • Safer reset links. Password reset emails always link to PolicyReadiness, or to your own broker or IT provider's address if your plan comes from them.

20 October 2026

  • A partner program. Insurance brokers, agents, and IT providers can now offer PolicyReadiness to their clients under their own name: their logo and color in the app, in the emails and reports, and on the Trust Center page, on a web address of their own domain. A partner adds its clients, chooses their plans, and pays per client. The partner's own analysts review the evidence, or ours do. Read about the program and apply.
  • A plan from your broker or IT provider. If your partner pays for your plan, the Plan page says who provides it, and you never see a payment page.

19 October 2026

  • Disk encryption from Google Workspace. A Google Workspace connection now also reads the devices Google knows, such as laptops with Endpoint Verification and managed phones, and saves a reading on "Disk encryption on laptops and mobile devices". If you connected before, the Integrations page shows the one scope a super admin adds. No new sign-in is needed.
  • Clearer device lists. The Google Workspace reading names each device by its maker and model when Google knows them. A device Google knows only by its operating system says so, with the day Google first saw it.
  • Start the next version from the version page. The page of the newest online template version now has "Start a new version from this one". It copies the answers and screenshots into a new draft.

17 October 2026

  • Online templates. No document yet? Each control now has an online template: the questions the underwriter asks, then one part for each kind of evidence. Answer it in the app and paste screenshots into it. The draft saves as you type. "Submit as evidence" turns it into files that your analyst and the automatic review read like any upload. Each submission is a version, and you can withdraw the newest one.
  • The Microsoft 365 connection is open. Owners of companies on Microsoft 365 Business Premium can connect it under Settings, then Integrations.
  • A connection message that stays. When Microsoft or Google sends you back to the Integrations page, the result stays at the top of the page until you close it.
  • Fixed: deleting a company with a Trust Center page. It failed before. It works now.

16 October 2026

  • Connect Microsoft 365 or Google Workspace. A new page, Settings, then Integrations, asks which service your company uses. Connect it, and PolicyReadiness reads your security settings with read-only access: MFA, admin accounts, accounts with no recent sign-in, disk encryption on devices, and email authentication (SPF, DKIM, and DMARC). Each reading is saved as evidence on its control, so you need fewer screenshots. A reading states facts. The automatic review and your analyst decide.
  • Checked every day. Connected settings are read again each day. A new reading is saved only when something changed. If a setting changes on a control your analyst already accepted, the control keeps its status, and your analyst and you get an email. Your analyst then confirms it with "Still holds" or gives a new verdict.
  • A newer AI model for reviews. The automatic review, the advisor, and the policy drafts now use Claude Opus 5.5.
  • One footer on every page. Each page of the website has the same footer, with the same links.

12 October 2026

  • Yearly checks. Proof gets old. Each control with accepted proof now gets a new check 12 months after its newest file. The remediation plan has a new tab, "Yearly checks": what is due now, what is due in the next 60 days, and the rest by month. A control page says when its next check is, and the dashboard shows the checks that are due. A check that is due does not change a status or a score by itself. The weekly reminder email names the checks that are near their date, from 30 days before to 30 days after.
  • A way out of the demo in view. In the demo, "Leave demo" is in the top bar of each page.
  • Fixed: files that stayed in the virus check. The scanner got its new virus list each day, but in some cases it kept the old list in use, and it then refused each file. It now loads the new list before it starts, and it checks each 5 minutes that it uses the newest list.

10 October 2026

  • Icons that say what a thing is. Each control shows the icon of its area: on the dashboard, in "Controls & evidence", on the remediation plan, and in the reports. The training lessons, the modules of the Policy center, the advisor's questions, and the settings pages have icons too.
  • One "Settings" line. Team, Plan, Frameworks, Activity, Email notices, and Sign-in security are now under "Settings" in the menu. The Settings page shows what is set now. Each page keeps its address, so your old links work.
  • AI policy is in the Policy center. If your company uses the AI Governance framework, "AI policy" is now the last tab of the Policy center.
  • The search icon works on each page. The search icon at the top now opens "Controls & evidence" from any page, with the cursor in "Find a control". Before, it worked on one page only.
  • Tables are easier to read. The header of each table is the blue of the buttons. The name of a control is in dark text, and its icon is blue.
  • A clearer Trust Center. A certificate page shows first if the certificate is valid. Dates are written in full, and each framework has its icon.

30 September 2026

  • One look, in Light or Dark. PolicyReadiness now has one look, Fox. The "Theme" button switches it between Light and Dark, and your browser remembers your choice. If you used the old Dark or Green theme, you start in Dark.
  • Easier on a phone. The top bar fits small screens, and long names and dates stay inside their cards.

29 September 2026

  • No "0%" on day one. Until half of your controls are reviewed, the score circle counts the reviews ("1/24 reviewed") and says when the score shows ("Score after 12 reviews").
  • Steps you can trust in Sky and Fox. Each step shows how far it is and links to where you do it. "Evidence uploaded" is checked only when every critical control has a file. The third step is now "Critical controls supported".
  • Lists that do not look done. The evidence examples and the review requests use plain dots, not check marks. The review requests show once, in the upload panel.
  • One place to talk to a person. On a control, "Talk to your analyst" takes your questions. Tick "I disagree with the automatic review" to have a person review the file again.
  • Start, not assign, when you work alone. If you are the only person on the team, the plan button says "Start the first critical fix" and opens it.
  • Bigger buttons on phones. On a touch screen, buttons, menu links, tabs, and icons are at least 44 pixels tall.
  • You can see where you are on a phone. The menu row scrolls to the page you are on. Links in lists are easier to tap.
  • A way forward when the advisor is paused. The Advisor page says so and has an "Ask your analyst" button.
Show 20 more changes from 29 September
  • One first step. The plan's "Start the first critical fix" opens the same control as your next step on the dashboard. Getting started stays until you have sent proof for 5 controls.
  • Clearer fix lists. The Critical label comes before the fix name, owners say "Owner:", and Overdue comes first.
  • Calmer Fox and Sky. The status labels are smaller, and Activity has a clock icon, not a bell.
  • The broker report waits for real proof. Until your analyst accepts your first proof, the Broker report tab says so and shows your next step. You cannot print or share a report of zeros. The full report and the summary still open as drafts.
  • Clear about who looked. When only the automatic check asks for more proof, the page says "More proof asked" and tells you your analyst has not seen it yet. Your analyst sees it when you upload new proof or tell them you disagree. A verdict from your analyst still says "Needs work".
  • "Checked", not "reviewed". Early on, the score circle and Getting started count checks, automatic or by your analyst.
  • One name for one state. The Controls tab and the counts say "Needs more proof".
  • Easier to disagree on a phone. On a control, "tell them you disagree" takes you straight to the message box.
  • A person checks the critical ones. When the automatic check asks for more proof on a critical control, your analyst now sees it too and confirms or changes it. You do not need to wait: you can add what it asked for right away.
  • Easier to say you disagree. On a critical control, "Tell my analyst why" sends your reason with the message.
  • Activity uses the same words. A new automatic check shows in Activity as "More proof asked", the same as the tag on the control.
  • Your analyst is told by email. When the automatic check asks for more proof on a critical control, your analyst gets an email, and its subject says what waits, for example "1 new file, 1 critical check to confirm".
  • You can see when your analyst has it. A critical control that your analyst is confirming shows "With your analyst", and the dashboard counts say how many.
  • The task comes first. When a control needs more proof, the upload form is now right under the status, before the record.
  • Tidier lists. Tab counts have a space ("All 24"), and Getting started lists its steps in the order they happen.
  • Shared summaries open again. A link to the executive summary showed a blank page for a short time. It is fixed, and links you already sent work again.
  • Upload first, from day one. On a control with no proof yet, the upload form is now the first thing under the status.
  • The broker report says who accepted each control. Each Supported row says whether your analyst or the automatic check accepted it.
  • A new default look: Fox. The website and the app now open in Fox: a clean white page, a light blue work area, and a menu with icons. If you picked another theme before, you keep it. The Theme button still offers Navy and the others.
  • Fox on the website too. The Theme button on the website now offers Fox, and the Product page shows the app in Fox.

28 September 2026

  • Your renewal on the dashboard. Save your renewal date, and the dashboard shows the days left and the critical controls that still need accepted proof.
  • A calmer start. Until half of your controls have a result, the dashboard shows how many are reviewed, not a red "Not ready".
  • Know what to upload. When a review asks for more proof, the upload form lists what it asked for, above the place where you choose files.
  • A clearer control page. The upload form sits under your files, and the message form under the review notes.
  • Fixes and critical controls. The plan and the dashboard say how many fixes close your critical controls. One fix can close more than one control.
  • More reliable reviews. A review no longer stops when another file fails the virus scan, and a large set of PDFs no longer makes it fail.
  • Easier to read. The Advisor's answers, the delete button, and the small status labels are easier to read.
  • Find a control. On the Controls page, search by name, and show only the critical controls. Press / to go to the search box.
  • A calm report before sign-off. Until the analyst signs off, the report is marked as a draft. Early on, it shows how many controls are reviewed, like the dashboard, and not a red "Not ready".
  • Renewal date as a first step. "Add your renewal date" is now a step in Getting started, and the plan reminds you when there is no date.
  • Assign the critical fixes faster. After you give one critical fix an owner, the next one without an owner opens.
  • Two new looks. The "Theme" button now also offers Sky and Fox: a bright page, one white frame, a top bar with search and your initials, a menu with icons, and a dashboard with your readiness score and four steps to your application.
  • A new logo. PolicyReadiness has a new logo: a shield with a document and a green check. It is also the new browser icon.
  • Plainer words. The automatic review says how sure it is ("The software is 71% sure"), the report button says "Download data (JSON)", and a report without accepted proof yet says so, not six empty bars.
  • Honest steps in Sky and Fox. "Analyst review" gets its check only after a person reviews your proof, not after the automatic review. The score card also says "Not signed off yet" or "Signed off".
  • Your next step comes first. In Sky and Fox, the dashboard starts with your next step, then the score and the four steps.
  • No double ask. While the renewal date form is on the dashboard, "Add your renewal date" is not also a Getting started step.
  • A shorter early report. Before half of your controls are reviewed, the report lists the critical controls and the ones with proof, then one line for the rest. Until sign-off, the button says "Print draft / save PDF".
  • Clearer fix lists. The dashboard card is always "Next fixes", with a Critical label on critical fixes. The plan says "none assigned yet" once per group, not on every row.

27 September 2026

  • Add proof in parts. Upload the files for a control at different times. Each automatic review looks at all the files of the control together, not only the newest one.
  • Delete a file. Delete a file that you uploaded by mistake. The activity log keeps who deleted it, when, its name, and its fingerprint. The files that are left get a new review.
  • Past reviews. When a file is deleted, its automatic review moves to "Past automatic reviews" on the control page. Each one shows its date, its result, and why it is there.
  • A faster virus scan. The first scan after a quiet time is faster. While a file is checked, the control page says so, and it updates by itself.
  • Every control gets its review. Some controls with long names got no automatic review. That is fixed.
  • Critical fixes first. The remediation plan puts the fixes for critical controls first, with the days left to your renewal date.

26 September 2026

  • Clearer plans. Each plan on the home page says who reviews your evidence and names the frameworks that you can pick.
  • See a control before you sign up. The home page shows one control as it looks in the live demo: the file, its fingerprint, the virus scan, and the note of the analyst.
  • From the readiness check to your account. After the check, you go straight to sign-up with your gaps. The demo is one click away.

25 September 2026

  • A new look. Pages open with a white background and navy cards. The "Theme" button still changes it.
  • A readiness check that names your gaps. The result lists each gap and the proof that insurers want for it, with a free template where one exists.
  • Fewer refused PDFs. Large PDFs, such as scanned policies, are no longer refused by mistake. The check also looks inside packed parts of a PDF, and in every part of an Office file.
  • Your work stays on the page. While the automatic review runs, the control page no longer clears the message or the files that you are working on.

24 September 2026

  • A new name. CyberHawk is now PolicyReadiness, at policyreadiness.com.
  • Remediation plan. One list of fixes for all your frameworks, with the most important first. An owner gives each fix to a person and sets a due date. A late fix is in the weekly reminder email of that person.
  • Advisor. Ask questions about your readiness in a private chat. The answers use the data of your company. You can clear the chat, and messages are deleted after 30 days.
  • AI Governance. A new framework with an anonymous staff survey about the AI tools that people use, and an AI Use Policy draft that you download as a Word file.

23 September 2026

  • HIPAA Security Rule. A new framework for health care companies, with the citation of each control.
  • Pick your frameworks. Choose your frameworks at sign-up and on the "Plan" page. The number depends on the plan.

22 September 2026

  • Automatic evidence review. After the virus scan, each file is read and the control is marked Supported, Needs work, or Human review, with a reason and a list of what is missing. When the review is not sure, a person decides. You can dispute any result.

21 September 2026

  • Payments. You pay for your plan with a card. The payment page is on stripe.com, and PolicyReadiness never sees your card. The new "Plan" page shows your plan and opens the Stripe page where you change the plan, change the card, get invoices, or cancel.
  • Templates. Ten templates for evidence that a company writes itself: an incident response plan, a password policy, a restore test record, an offboarding checklist, a payment verification procedure, a business continuity plan, a tabletop exercise, and three inventories. Each one is on its control page and on the help page.
  • Help, contact, and this page. A help page with a search box, a form to write to us, and this list of changes.

20 September 2026

  • Email notices. We send you an email when your analyst reviews your evidence or writes to you, and one reminder each week while a control needs work. Each email has a link that stops the emails. You also have switches under "Email notices".
  • Team. A company can have more than one person. An owner invites people by email on the new "Team" page. The number of people depends on the plan.
  • Share a report. Send the broker report or the executive summary as a link or by email. The reader needs no account. A link works for 30 days, and you can turn it off.
  • Sign-in and sign-up are two pages. The top menu has a "Sign up" button and a "Sign in" button.
  • Better on a phone. Tables become lists on a small screen, the menu is one line, and buttons are larger.

19 September 2026

  • Three reports. The full report, a one-page executive summary, and a report for your insurance broker. Each one prints to PDF.
  • Two-step sign-in. Add a 6-digit code from an authenticator app to your sign-in. Analysts must use it.
  • A live demo. A sample company that anyone can open with no account. It is read-only.
  • Stricter file checks. Office files with DDE commands are refused, in addition to macros, embedded objects, and active PDF content. Each file also gets a virus scan.
  • Limits against misuse. Limits on wrong passwords, sign-ups, and uploads.