Coming soon

Policies signed, training proven, in one evidence pack.

PolicyMgr is a policy hub with employee attestation. Acceptable use, the handbook and sector policies (HIPAA, GLBA, FERPA) are acknowledged by each person and re-acknowledged on a schedule, next to the training certificates RuleCrest already issues.

See the evidence pack All add-ons

Why small organizations need it

Policies plus proof of training

Customers, insurers and regulators ask for the same two things: that written policies exist, and that the people who work there have been trained and have acknowledged them. Having the policy is the easy half. The hard half is showing, on a date, who read which version.

Cyber insurance applications and renewals commonly ask about written security policies and staff training.
Customer security questionnaires ask the same questions, and often ask for evidence.
Several regulations name the training and the paperwork outright, as the table shows.

Sector	Rule	What it asks of the organization	How PolicyMgr helps
Healthcare	HIPAA Security Rule, 45 CFR 164.308(a)(5)	A security awareness and training program for the whole workforce, management included.	Shows who completed training, next to the policies each person acknowledged.
Healthcare	HIPAA, 45 CFR 164.316(b)(2) and 164.530(j)	Keep the required documentation, including policies, for six years.	Keeps every policy version and every acknowledgement, with dates.
Financial services	FTC Safeguards Rule under GLBA, 16 CFR 314.3 and 314.4(e)	A written information security program, and security awareness training for personnel.	Holds the program's policies and records who acknowledged them.
Education	FERPA, 34 CFR Part 99	Protect student education records and limit who they are disclosed to.	Records that staff who handle records acknowledged the student-records policy.

A summary of the rules for orientation, not legal advice. Checked October 20, 2026; ask counsel what applies to you.

How it works

Publish, assign, acknowledge, repeat

Keep the policies in one place
Start from sector templates for acceptable use, the handbook and the policies your rules name, or add your own. Every change makes a new, dated version.
Assign them to people
Send a policy to everyone, a team, or a role. People find it on their dashboard next to their training.
Each person acknowledges
A person reads the policy and confirms with their RuleCrest identity. The record holds who, which version and when.
Repeat on a schedule
Acknowledgements renew every year, or sooner when a policy changes, with reminders so nothing quietly lapses.

Pairs with RuleCrest certificates

One pack instead of a hunt through email

RuleCrest already issues a certificate when a person completes a course, and anyone can verify it. PolicyMgr adds the other half of the proof: the policies each person acknowledged. Together they form one evidence pack for a questionnaire, a renewal or an audit.

EXAMPLE · MADE-UP FIGURES

Evidence pack: Example Clinic

Policies: Acceptable use, privacy notice handling, security policy (6 in force)
Acknowledged: 41 of 43 people, each with the version and date
Training: 40 of 43 people completed, each with a certificate
Due soon: 2 people to re-acknowledge by month end

Generated from signed records. Illustration only; no real organization.

Scenarios

When someone asks you to prove it

Illustrative scenarios, not reports of real events.

The security questionnaire

A prospective customer sends 80 questions. Two of them: "Do staff acknowledge your acceptable use policy every year?" and "Please provide evidence of security training."

With PolicyMgr the answers come from one export, with names, versions and dates, instead of an afternoon of searching mailboxes.

The insurance renewal

The cyber-insurance renewal form asks what share of staff completed training and acknowledged the security policy this year.

The owner reads the two figures from the pack and sends the form the same day.

After an incident

A regulator or insurer asks which version of the policy was in force on the day of an incident, and whether the person involved had acknowledged it.

Each version is dated and every acknowledgement names the version, so the answer is a lookup and not a guess.

Privacy by design

What PolicyMgr receives from RuleCrest

It receives

An opaque identifier for the person that is stable for this add-on and organization.
The organization, the person's name and email, and their role.
The seat count the organization bought.

It does not receive

Anything that changes a person's training record. A launch never changes it.
A password. RuleCrest has none to give: people sign in with passkeys.

An acknowledgement is a record of who confirmed which version and when. Whether it counts as a signature for a given purpose is a question for your counsel.

Sources

Checked October 20, 2026.

Code of Federal Regulations: 45 CFR 164.308(a)(5) (security awareness and training), 164.316(b) (documentation and its six-year retention) and 164.530(j) (privacy documentation).
Code of Federal Regulations: 16 CFR Part 314, the FTC Safeguards Rule (a written information security program, and training of personnel).
Code of Federal Regulations: 34 CFR Part 99, FERPA (student education records).