Policy Withdrawal and Archival (POL-003-R005) - POL-003

Requirement Details & Guidance

POL-003-R005 · POL-003

Why This Requirement Exists

To prevent superseded policies from continuing to be treated as authoritative while preserving historical evidence and accountability.

Implementation Guidance

Define withdrawal criteria; obtain required approval; remove superseded policies from active distribution; mark them as retired; archive according to retention requirements; update references in related documents and systems.

Practical Application & Audit Readiness

POL-003-R005 · Field Guidance

Business Examples

Common Audit Findings

Common Mistakes

Best Practices & Ownership

POL-003 · Recommended Approach

Recommended Practices

Typical Owner

Cross-Mapped Regulatory Frameworks

Harmonized Control Mappings

FRAMEWORK CODE	FRAMEWORK NAME & DETAILS	FAMILY / CATEGORY	VERSION	ACTION
COBIT2019	COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO01 – Managed I&T Management Framework > APO01.09 – Define and communicate policies and procedures.	COBIT Governance Framework	v2019	View →
DORA	Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 6(5) – Documentation, annual/periodic review and continuous improvement of ICT risk management framework Article 13(3) – Incorporation of testing/incident lessons into ICT risk assessment and framework	EU Regulation	vCurrent	View →
HIPAA	Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.316(a)(1) Policies and procedures documentation	US Law	vCurrent	View →
IRDAI	IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.5-IV – Review Frequency	India Guideline	vLatest	View →
ISO22301	ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 7.5.2 – Creating and updating; 7.5.3 – Control of documented information	ISO Standard	v2019	View →
ISO27001	ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 5.2 – Policy	ISO Standard	v2022	View →
ISO27002	ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.1 – Policies for information security	ISO Standard	v2022	View →
NIS2	NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(a) – Policies on risk analysis and information system security	EU Directive	vCurrent	View →
NIST-CSF	NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.PO – Policy \| GV.PO-01 – Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced GV.PO – Policy \| GV.PO-02 – Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission	NIST Framework	v2	View →
NIST80053	NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.12 – PLANNING; PL-3 – SYSTEM SECURITY PLAN UPDATE, PL-1 – POLICY AND PROCEDURES	NIST Control Catalog	vRev. 5	View →
NPCI-ISR	NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Governance Controls; Policy, Roles and Risk Linkages – Periodic policy reviews and updates	India Standard	vLatest	View →
PCI-DSS	PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.1.1 – An overall information security policy is:	PCI Standard	v4	View →
RBI-CSF	RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §3 – Need for a Board approved Cyber-security Policy; Circular §16 – Immediate assessment of gaps in preparedness	India Regulation	vLatest	View →
SEBI-CSCRF	SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.3 GV.PO: Policy	India Regulation	vLatest	View →
SOC2	SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action. CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.	AICPA Audit Framework	vLatest	View →

Parent Domain Context

Governance Domain Baseline

Domain Name:

Policy & Document Management (POL)

Purpose:

To create, maintain, and manage the lifecycle of security and compliance policies, standards, and procedures.

Scope:

Enterprise

View

Parent Control Context

Control Baseline

Control Name:

Policy Review & Update (POL-003)

Summary:

Establishes periodic review and update processes to ensure policies, standards, and procedures remain current, relevant, and effective in addressing evolving threats and regulatory requirements.

Business Description:

Regularly review and update security policies and standards to ensure they remain current and effective.

View