Centralized Storage for Non-Policy and ISMS-Specific Documents | 💡 Feature requests

Centralized Storage for Non-Policy and ISMS-Specific Documents

Sascha S.

Request
I would like to see a centralized repository within the platform for two types of documents that currently lack a dedicated space:
Documents not directly linked to Policies (POLs) – such as cloud exit strategies, backup strategies, or overarching compliance frameworks. These documents are important for audits and internal controls but do not fit neatly under specific policies.
Documents exclusively related to the ISMS (Information Security Management System) – such as ISMS-specific procedures, frameworks, or strategic documents that are essential for managing the system but aren’t tied to individual POLs.
Benefits
Clear and structured access to critical compliance documents.
Better support for audit readiness and ISMS maintenance.
Reduced risk of document scattering and information loss.

Created by Sehmus El

Sascha S.

Hi Grigory,

The thing is, we want to make the documents available on the platform for this and other audits. Having them available on the platform would have made our work easier during the audit. We had to set up a separate environment for the auditors to access. As a result, we are currently working with two environments: Secfix and our internal document storage system. This isn't a problem in principle, but it would be great if we could control everything from one environment — or at least connect the environment to SecFix so we don't have to upload and download documents repeatedly. It would be easier and more convenient.

Grigory Emelianov

Thanks for the feedback! The main benefit we are chasing at Secfix for users is to make things tidy, clean and structured. By introducing a folder logic to collect more docs I think you will actually loose structure that Secfix gives you long term by adding more and more loose documents that are not connected to any specific purpose. 
Are the documents you suggest to add the documents that you will show during the audit? Or something you collect 'just in case'?
Can you make more specific examples for "Documents exclusively related to the ISMS (Information Security Management System) – such as ISMS-specific procedures, frameworks, or strategic documents that are essential for managing the system but aren’t tied to individual POLs."? I don't know any document that is not covered by manual evidence or policies but I'd be happy to get your opinion here!