Policy Update Procedure

Document Info

Version: 2026.2 · Last Reviewed: 2026-02-18 · Classification: Internal · Owner: CISO View Source · Download PDF

Scope

Applies to all documents in Meridian7-io/m7-security: policies (policies/), procedures (procedures/), and guides (guides/).

Review Schedule

Review Type	Frequency	Owner
Annual review	Every 12 months from effective date	Policy owner
Triggered review	After significant incident, org change, or regulatory update	CISO
Ad-hoc update	As needed for corrections or clarifications	Policy owner

---

Update Process

Step 1 — Edit on Staging

1. Switch to staging branch in m7-security.
2. Edit the policy markdown file(s).
3. Update Last Reviewed to today.
4. Update Effective Date if this is a material change.
5. Add a new row to Version History describing the change.
6. Commit and push to staging.

Step 2 — Open Pull Request

1. Open a PR from staging → main.
2. Fill in the change summary and impact assessment.
3. CI automatically validates: Owner/Reviewer fields present, Last Reviewed is current, Version History section exists. CI also generates preview PDFs as PR artifacts.

Step 3 — Review and Approval

1. A reviewer other than the PR author must approve — branch protection enforces this.
2. Reviewer: download and review preview PDFs from CI artifacts; verify consistency with related policies; confirm PR description accurately describes the change.

Step 4 — Automatic Publishing

On merge to main, GitHub Actions automatically:

1. Creates the next Git tag.
2. Generates final PDFs with version, commit SHA, and repository injected.
3. Creates a GitHub Release with PDFs attached.

No manual steps required after merge.

Step 5 — Distribute

1. Notify all personnel of material changes via Slack #general.
2. For new policies or significant changes, require re-acknowledgment within 30 days.
3. Update linked GitHub issues on the SOC 2 project board if the change relates to control work.

---

Version System

Versions are GitHub Release tags created automatically on each merge to main. Version numbers are never manually maintained in source markdown — injected into PDFs at generation time.

Concept	Mechanism
Version number	Git tag (auto-incremented)
Change justification	Pull Request description
Approval record	PR review approval (non-author)
Audit trail	Git commit history + GitHub Releases
Published artifact	PDF attached to GitHub Release

Every published PDF contains Version, Commit SHA, and Repository in its Document Control table, traceable to the exact source, PR, and approval.

---

Storage Locations

Artifact	Location
Source markdown (authoritative)	policies/*.md
Procedures	procedures/*.md
Guides	guides/*.md
Published PDFs	GitHub Release attachments
Browsable policies	GitHub Pages (m7-security)
PDF generator	policies/generate-pdfs.py

Branch	Purpose	Protection
main	Production — published policies	PR required, non-author approval, signed commits
staging	Draft changes	Open for direct push

---

Meridian Seven — Confidential