---
sourceDocument: Xanadu Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/governance-risk-compliance

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Create a policy

# Create a policy {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

A policy defines an internal practice that processes must follow. Policies are
defined as policies, procedures, standards, plans, checklists, frameworks, and
templates.

## Before you begin

Role required: sn_compliance.admin or sn_compliance.manager

Users with Compliance user (sn_compliance.user) role can also create policies.

## Procedure

1. Navigate to AllPolicy and CompliancePolicies and ProceduresPolicies.
2. Click New.  
3. On the form, fill in the fields.  
   {#t_DefineAPolicy__table_FloorForm__entry__2}

   | Field | Description |
   |-|-|
   | Name | The name of the policy. |
   | Type | List of options: * Policy * Procedure * Standard * Plan * Checklist * Framework * Template {#t_DefineAPolicy__ul_yxs_dhs_wt} |
   | Owning Group | Group that owns the policy. |
   | Owner | User that owns the policy. |
   | Compliance Score Percentage | The compliance score percentage assigned to this policy. |
   | Parent | The policy containing this policy. If you create a control objective from within a policy, this field is automatically filled. |
   | Policy categories | Click the lock icon and select one or more categories for filtering policies. For example, select Vulnerability Response to view policies associated with that application. |
   | State | The state is a read-only field. Possible choices are: * Draft In this state, all compliance users can modify the policy and control objectives. All compliance users can click Request review button. Enter a message in the Request review pop-up and click Request , which sets the state to Review. * Review In this state, the owner, owning group, and reviewers can modify the policy and control objectives. The owner, owning group, and reviewers click Request approval, starting the workflow by sending approvals to the users in the Approvers list. The owner, owning group, and reviewers move the policy back to Draft, by clicking Back to draft, as well. * Awaiting approval In this state, the policy and control objectives are read- only for all. Approvers can approve the policy by updating the approval state in the Approvals Related List on the policy form, or by viewing My Approvals. If the policy is approved, the policy goes to the Published state. Otherwise, it goes back to the Review state. * Published In this state, the policy and control objectives are read-only for all. Admins can click Retire which sets the state of the policy to Retired * Retired In this state, the policy is read-only for all. {#t_DefineAPolicy__ul_xd3_ggp_15} |
   | Valid from | The date and time for which the policy becomes valid. |
   | Valid to | The date and time for which the policy is no longer valid. |
   | Approvers | The users you want to be included in the approval process. |
   | Reviewers | Select the users you want to be included in the review process. |
   | Description | A general description of the policy. |
   | Policy text | A detailed description of the policy. |
   | Knowledge Base ||
   | Knowledge base | The knowledge base article related to this policy. |
   | KB article | The KB article number and link where the policy is published. |
   | Article template | The article template to use for the publication of this policy. |
   | Acknowledgement Setup ||
   | Audience | Select the default audience responsible for acknowledging this policy. |
   | Reference Material URL | Click the lock icon to add the URL for any needed reference materials, such as certification or training materials. |
   | Allow users to decline policy | Select this check box to give users the option of declining policy acknowledgements. |
   | Allow users to request exception | Select this check box to give users the option of requesting exceptions for policy acknowledgements. |
   | Exception Setup ||
   | Maximum exception duration (days) | Enter the maximum number of days for which a policy exception can be requested for a given policy. |
   [Table 1. Policy]

   {#t_DefineAPolicy__table_FloorForm}
4. Continue with one of the following options.  
   * To save and submit the policy, click Submit.
   * To mark the policy ready for review, click Request review .
   {#t_DefineAPolicy__ul_hz1_52y_ljb}

## What to do next

If you are implementing the [Policy and Compliance Management](https://www.servicenow.com/docs/C~gjGlpEGD31j2ny56bzuA "This checklist includes the setup tasks that you are required to complete in your ServiceNow AI Platform instance. When you have completed these tasks, the base system is ready for operation. Optional setup procedures are also included to enhance GRC: Policy and Compliance Management functionality.") software, return to the [Policy and Compliance Management setup checklist](https://www.servicenow.com/docs/C~gjGlpEGD31j2ny56bzuA "This checklist includes the setup tasks that you are required to complete in your ServiceNow AI Platform instance. When you have completed these tasks, the base system is ready for operation. Optional setup procedures are also included to enhance GRC: Policy and Compliance Management functionality.") and proceed to the
next step.

*[\>]: and then