Abstract: A software program capable of creating and managing security policies on a network is disclosed. When a computer administrator selects a set of security controls based on the selected policy, it automatically communicates the controls to computer systems in the network capable of understanding this information. The computer systems can either be audited against this policy or altered to conform to the selected policy. Such changes might include enabling, disabling, deleting, moving or reassigning users, files or objects within the network. The invention further communicates this policy to individuals responsible for understanding the policy via a software program and tracks their reading and understanding of the policy via the same software.