New Feature: Internal Policies
Internal Policies, without the spreadsheets or LMS
Distributing a policy is easy. Proving it has been read, by the right people, on the right version, when the auditor asks, is where most teams come unstuck.
The manual approach is familiar: a SharePoint folder, a PDF attached to an email, and a spreadsheet someone updates when they remember to. It feels manageable until a compliance deadline arrives or a new hire joins and nobody is sure what they have been shown. And somewhere in the middle of it all, a battle between IT and HR for who is responsible.
The alternative is a full learning management system. But for most SMB and mid-market companies, that means a lengthy procurement process, a system employees need to learn, and more overhead for an IT team that is already stretched.
Internal Policy in the Pistachio platform sits between the two. No spreadsheets, no system to learn, and no ongoing administration. Just a clean, audit-ready way to track who has seen what.
"When it came to compliance audits, our customers could easily demonstrate when employees completed security training, but not when they had seen internal policies. Policy management in Practice fixes that - without adding another tool for the IT team to look after."
— Hanna Steingrímsdóttir, VP of Product
Simple by Design
Setting up a new policy takes less than two minutes. Upload a PDF, assign it to your entire organization or a specific department, and Practice handles the rest. Employees are notified, acknowledgments are tracked, and you have a clear view of who has and has not confirmed each document.
When a policy changes, upload the revised version. Version history is maintained automatically, giving you a clean record of what was in place and when, without any manual upkeep.
How Teams Are Using It
Compliance acknowledgment: Finance teams confirm they have read AML or DORA documentation, with automatic reminders for anyone who has not responded. Acknowledgment records are exportable when audit season arrives.
Operational policies: IT distributes instructions for new MFA apps, password managers, or internal tools and tracks who has read them instead of assuming the email was seen.
Onboarding: New hires see all relevant policies from day one in one place. No chasing documents and no gaps in what they have been shown.
Security alerts: When Presence flags a spike in suspicious activity, admins can distribute updated guidance to the whole organization immediately, with confirmation that it has been seen.
Annual and recurring compliance: Updated policies for certifications or audits are uploaded yearly, with version history and acknowledgment records ready when they are needed.
Incident response: After a security incident, updated instructions reach every employee quickly, so teams act consistently rather than relying on whether someone saw an email.
Audit-Ready Without the Admin Work
When it is time to demonstrate compliance, whether for ISO 27001, NIS2, Cyber Essentials, or an internal review, you can export a full report showing acknowledgment status across your organization. Send reminders to anyone who has not confirmed and know exactly where you stand before the auditor arrives.
New hires get immediate access to all relevant policies as soon as they are added to Practice. There are no onboarding gaps and no document hunting in their first week.
One Platform, One Less Compliance Challenge
Lightweight to set up, automatic to run, and one less thing on the IT team's plate. That is how Pistachio approaches every problem, and policy management is no different.
Policy management is available in Pistachio now. No matter which product your organization is using, it’s immediately available to you. Email contact@pistachioapp.com to see how Practice handles security awareness training and policy compliance in one place.
We believe in a learn-by-doing approach over snooze-worthy videos.
Instead, Pistachio tailors real-world scenarios so your team can build their cyber skills in a safe environment.
Continue reading
Ready to reduce your human risk? Book your demo today.
“We lacked confidence that employees would recognise today’s phishing threats or respond correctly. Since using the Pistachio platform, they are more attentive and proactive in identifying potential risks. The solution is easy to manage, quick to implement, and highly effective.
“The platform is easy to implement and provides clear insights into employee phishing awareness. Its bite-sized learning encourages participation, saves administration time, and allows us to focus more on real threat detection.”
“We were looking for a practical way to improve cybersecurity awareness across the organization. Pistachio made training simple and engaging, and we’ve seen a noticeable improvement in employee awareness with minimal effort.”
“Pistachio removed the burden of planning campaigns, collecting data, and evaluating results. The program challenges each employee at their own level and provides clear, simple reporting. Pistachio has streamlined our awareness training and strengthened our organization’s cybersecurity.”
“Our goal was to help employees better recognize phishing emails and avoid malicious links. Pistachio made this easy and engaging, and we’ve seen a clear improvement in detection, fewer clicks on phishing links, and reduced data disclosure. With minimal ongoing maintenance, it’s an effective and low-effort solution.”
“Within weeks, Presence had flagged several incidents that could have otherwise been missed, including employees forwarding company data to personal accounts during offboarding. The alerts are reliable and actionable, so we've built a full investigation process around them. Although I was skeptical at first, the value was obvious almost immediately.”
“Pistachio has reduced our manual workload to zero with its automated phishing simulations and in‑box delivery of scenario‑based trainings. This has allowed our team to dedicate time to other important security initiatives while Pistachio handles our Security Awareness program seamlessly.”
“Presence automatically detects suspicious behaviour and gives us the visibility we need without constant manual oversight. Within the first few weeks we were already seeing alerts that would have otherwise gone unnoticed as the system learns what is usual and unusual behaviour for our environment.”
“Before Pistachio, security awareness was something we could only offer to a few customers. Today it’s part of every managed service we deliver, and we haven’t had to grow the team to make that happen.”
Fill out the form to book a demo:
Trusted by 1200+ customers & MSPs
