How do I…?

Short answers for each step. If your question is not here, write to us with the form at the end of this page.

Search the help

Get started

Click "Sign up", fill in the form, and choose a plan. We send you an email. Click the link in it to confirm your address.
Then you pay for the plan. The payment page is on stripe.com. Your card details go to Stripe, not to PolicyReadiness.
After the payment, your dashboard opens. "Your next step" on the dashboard shows what to do first. If you did the readiness check first, your gaps are in the "Start here" list.
You want to look first? Open the live demo. It is a sample company, and you need no account.

Upload evidence

Open "Controls & evidence" and click a control. The page says what the underwriter asks and which evidence counts.
Choose your files and click "Upload proof". You can add a short note that says what the file shows.
Accepted types: PDF, PNG, JPG, GIF, WEBP, DOCX, XLSX, PPTX, CSV, TXT, LOG, JSON, MD. One file can be 10 MB at most. You can upload 10 files at a time and 200 files in one day.
We open and check each file before we store it. We refuse program files, Office files with macros or DDE commands, Office files with a password, PDF files with active content, and CSV files with formulas that start a program. If a file is refused, the page says why. Save the file again without macros, or print it to a new PDF.
Then each file gets a virus scan. While the label says "Virus scan running", nobody can download the file. The first scan after a quiet time can take some minutes.
Each file gets a SHA-256 fingerprint. It proves later that the file did not change.

Microsoft 365 and Google Workspace

Open "Settings", then "Integrations", and choose the service your company uses: Microsoft 365 Business Premium, Google Workspace, or something else. Only an owner of the company can connect it.
Microsoft 365: click "Connect Microsoft 365". A Global Administrator or a Privileged Role Administrator of your Microsoft tenant approves the permissions once. Microsoft shows them before anything is granted.
Google Workspace: a super admin first adds the client ID and the scopes shown on the page under Manage domain-wide delegation in the Google Admin console (Security, then Access and data control, then API controls). Then the same super admin clicks "Sign in with Google to connect". Google can take a few minutes to apply the first step.
The connection is read-only. It reads MFA, admin accounts, accounts with no recent sign-in, disk encryption on devices, and the public SPF, DKIM, and DMARC records of your email domains. It cannot change anything.
Each reading is saved as evidence on its control in the Cyber Insurance Readiness framework. A reading states facts. The automatic review and your analyst decide, as with an upload. A setting that cannot be read shows as "could not read". Upload a screenshot for it instead.
The settings are checked every day, and you can press "Check now". A new reading is saved only when a setting changed. If it changed on a control your analyst already accepted, the control keeps its status, and your analyst checks the new reading.
"Disconnect" stops the readings and keeps the evidence already saved. To remove the access on the other side too, a Microsoft admin deletes PolicyReadiness under Enterprise applications in the Microsoft Entra admin center, or a Google super admin deletes the client under Manage domain-wide delegation.

Templates

Some evidence is a document that your company writes itself. If you do not have it yet, start from a template. Replace each part in [brackets], delete what does not apply, and make sure that each sentence is true for your company. A template that does not match what you do is not evidence.
In the app, each of these controls has a link to its template. Upload the filled-in file on that control. The templates are a starting point. They are not legal advice.
Every control also has an online template. On the control, click "fill in the online template": answer the questions, and add screenshots with the button or paste them into an answer. The draft saves as you type.
Click "Submit as evidence" when it is done. The answers become a file, and each screenshot a file of its own, with the same virus scan as an upload. Your analyst and the automatic review read them like any other evidence.
Each submission is a version. Open the newest version to print it, to withdraw it, or to start a new version from it.
Incident response plan DOCX
Tabletop exercise: agenda and notes DOCX
Restore test record DOCX
Business continuity plan DOCX
Password and authentication policy DOCX
Account offboarding checklist DOCX
Payment change verification procedure DOCX
Asset inventory CSV
Vendor list with risk notes CSV
Sensitive data inventory CSV

What the statuses mean

"Not started": no evidence yet.
"In review": you uploaded evidence, and the review is not done yet.
"Supported": the review found proof that the control is in place.
"Needs work": the review needs more. Read the review on the control, and upload new evidence. The status then goes back to "In review".
"Human review": the automatic review could not decide, or you asked for a person. A PolicyReadiness analyst looks at it.
"N/A": the control does not apply to your company. It does not count for the score.

Your readiness score

The score is the weight of your supported controls, divided by the weight of all controls that apply. A critical control has the weight 3, an important control 2, and a supporting control 1.
"Ready to apply" means a score of 75% or more, and each critical control is supported. Underwriters look at the critical controls first.
When you are ready, your analyst signs off the assessment. New evidence or a changed verdict opens it again.

Work with your analyst

Each control has a message box. Write your question there, and your analyst answers on the same control.
We send you an email when your analyst gives a verdict or writes to you. Verdicts of the same 10 minutes come in one email. The email holds the name of the control, the result, and a link. It never holds the text of a note.
While a control is on "Needs work", you get one reminder each week, for 5 weeks at most.
You can turn these emails off under "Settings", then "Email notices", or with the link at the end of each email.

Reports and sharing

Open "Reports". There are three: the full report, the executive summary for an owner or a board, and the broker report for your insurance broker.
"Print / save PDF" uses the print dialog of your browser. Choose "Save as PDF" there. A report says "Draft" until your analyst signs off.
To send a report, open the executive summary or the broker report. Type the email address of the reader and click "Email the report", or click "Make a link to copy". The reader needs no account and sees that one report only, with no files.
A link works for 30 days. We show it one time only, so copy it then. You can turn a link off at any time. A company can have 10 active links and can send 5 report emails in one day.
A shared report shows the state of today. It is not a frozen copy.

Your team

Open "Settings", then "Team". An owner can invite people: a partner, the office manager, the IT provider. The person gets an email with a link to set a password. The link works for 7 days.
An owner can invite and remove people and change roles. A member can do all other work: upload evidence, write to the analyst, and make reports.
The number of people depends on the plan: Essentials 2, Guided 5, vCISO 15.
A removed person cannot sign in, and the name stays in the activity record. One email address can be in one company only.

Plan and payment

Open "Settings", then "Plan". An owner clicks "Manage plan, card, and invoices". That page is on stripe.com. There you change the plan, change the card, get your invoices, or cancel.
You pay each month. If you cancel, the plan runs to the end of the paid month.
If a payment fails, you keep full use for 7 days while Stripe tries again. After that the account is read-only: you can look and export, and you cannot upload or change.
We delete nothing when a plan ends. Pay for a plan again, and you work on where you stopped.
Your plan comes from your broker or IT provider? Then they pay for it, and the Plan page says so. Write to them to change the plan.

Sign-in and security

Your password needs 10 characters or more. You forgot it? Click "Forgot password?" on the sign-in page. We send a link that works for 1 hour.
After 8 wrong passwords from one network, the email address is locked on that network for 15 minutes. You can still sign in from another network. A password reset lifts the lock.
Two-step sign-in: open "Settings", then "Sign-in security", and scan the picture with an authenticator app. Then each sign-in also asks for a 6-digit code from the app. Save the 10 recovery codes. We show them one time only.
You lost your phone? Use a recovery code. You lost the codes too? Write to us with the form below. An admin can reset two-step sign-in after a check that it is you.
The security page says how we guard your files.

Write to us

A question, a problem, or an idea. A person reads each message. We answer by email, on working days.