As you prepare for your SOC 2 audit, you will be making adjustments to current processes and practices. So, it is understandable to be a bit unclear on what should be included in the policies your employees will accept.

If you think adjustments in process and/or practice will be quick to implement (say in the next week to month), then we’d recommend including them in the policy and letting your employees know about the upcoming changes. The alternative, is to leave the adjustments out of your current policies, and then create new policy versions when the practice is implemented in the future. With the latter option, you’ll just create and approve a new version of the policy, and your employees will need to re-accept the updated policy in Drata.