Tailored for Defence: Why Generic AI-Generated Policies Fail DCC Governance

Ask an AI assistant to write an Acceptable Use Policy, and it will produce something plausible-looking in seconds: don't share your password, don't click suspicious links, use company devices responsibly. It will also produce almost exactly the same document for a bakery, a bank, and a defence supplier.

That is the problem. Defence Cyber Certification (DCC) governance controls are not looking for a plausible-looking policy; they are looking for evidence that your organisation actually thought about its own risks and wrote the answer down.

What Control 1100 actually asks for

Under Objective A (Managing Security Risk), Control 1100 requires documented governance policies to be in place. Using AI to help draft that documentation is entirely permitted; plenty of well-run organisations now start policy drafts this way.

What is not permitted is stopping there. A generic template, AI-generated or otherwise, that has not been actively shaped around how your organisation actually works will not satisfy an assessor, because it does not demonstrate that governance is real rather than decorative.

The distinction matters more than it might sound. An assessor is not grading your prose. They are trying to answer a specific question: if this policy were tested tomorrow by an incident, an audit, or an employee genuinely unsure what to do, would it hold up? A template answers that question with silence.

Acceptable Use Policies have to cover more ground than most drafts do

For HR professionals and compliance writers, the Acceptable Use Policy (AUP) is usually the document that gets the most attention and the one most likely to fall short if it is drafted generically. DCC expects an AUP to enforce restrictions across both the digital and the physical environment, which is a wider brief than most standard templates attempt:

• Clear desk and clear screen policies — what employees are expected to do with sensitive material and unlocked devices when they step away from a desk, in an office or at home.
• Social media restrictions — what can and cannot be shared publicly, particularly anything that could reveal defence-related work, client relationships, or site details.
• Off-site handling of corporate assets — the rules for laptops, documents, and access credentials once they leave a controlled office environment.
• Remote activation of collaborative devices — an easy one to miss entirely. Meeting cameras and microphones that can be activated remotely for calls create a genuine physical surveillance risk if left ungoverned, and the policy needs to say explicitly how that risk is managed.

A generic AUP template will typically nod at the first of these and miss the rest completely, simply because they are specific to how defence-adjacent organisations actually operate.

What assessors look for beyond the document itself

Even a well-tailored policy is only half the evidence an assessor wants. The other half is proof that the policy is a living part of the organisation, not a document written once and filed away. In practice, that means being able to show:

• A clean revision history — evidence that the policy has been reviewed and updated over time, with dates and version changes, rather than appearing as a single undated file.
• Documented incident reviews that led to policy changes — if something went wrong, or nearly went wrong, and the policy changed as a result, that trail needs to be visible. It is some of the strongest evidence of a genuinely functioning governance process.
• Verifiable logs of employee sign-off — records showing that staff have actually read and acknowledged the policy, not just that it exists somewhere on a shared drive.

None of this is exotic. It is the same discipline any well-run HR or compliance function should already be applying to its policy library. The difference DCC introduces is that this discipline now needs to be demonstrable, on request, to an external assessor.

Where to spend the effort

For HR teams and compliance writers preparing governance documentation, the highest-value use of time is not agonising over wording, AI tools are genuinely useful for getting a solid first draft down quickly.

The value is in the next step: sitting with someone who actually understands how the organisation works, walking through each policy line by line, and asking "is this actually true for us?" That is the step a generic template, however well-written, cannot do on its own.

If your organisation is reviewing its governance documentation ahead of a DCC submission, speak to Periculo. We help compliance and HR teams turn policy drafts into documentation that stands up to assessment, with the revision history and sign-off evidence to back it up.