Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we get staff to acknowledge policies, and chase those who don't?

3 decision pointsThe pack behind this answer: Security Policy Management

Add to board memo

The short answer

Recommendation
Ask for acknowledgement of policies only, when someone joins or moves role, when a policy gets a new major version, and once a year. Remind people before their deadline, name anyone past it to their line manager, and report coverage and overdue acknowledgements to management every quarter.
Reasoning
An acknowledgement is a person's recorded confirmation that they have read a named version of a policy and will follow it. Only policies are acknowledged individually; the people who operate standards and procedures are trained on them. Opening a file is not an acknowledgement, so it must be a deliberate act, such as ticking a box or signing. The line manager is the escalation point because the manager can make it happen, and the quarterly report puts the decision on persistent non-compliance with management.
Considerations
  • The windows and targets are the CISO Times policy pack's defaults: 10 working days for joiners and movers, 30 calendar days after a material change, a reminder 5 working days ahead, 95% coverage, none over 30 days overdue. Your framework may set others.
  • A minor version needs no new acknowledgement: an acknowledgement of 2.1 is current for 2.2 but not for 3.0. A re-acknowledgement after a material change in the last 12 months counts as that year's acknowledgement of the policy.
  • Include contractors, and a provider's staff who use your systems where the contract requires them to follow your policies, with the provider's account manager as their manager. In an NIS2 or DORA entity, management body members acknowledge too.
  • If you cannot tell from your records whether someone is still overdue, treat them as overdue. Someone who repeatedly fails to acknowledge after reminders is handled under your disciplinary procedure, or the supplier's performance terms.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartStaff must acknowledge the policies that apply to themStepList the policies in force that need acknowledgingStepConfirm who is in each policy's scopeDecisionWhat prompts the request?OutcomeNo new acknowledgement neededStepAsk for every applicable policy within the joiner windowStepAsk everyone in scope within 30 days of publicationStepOpen the annual cycle for every applicable policyStepRecord a deliberate act: person, document, version, dateStepRemind people 5 working days before their deadlineDecisionDid they acknowledge by the deadline?StepName them to their line managerDecisionIs anyone still overdue?OutcomeReport them to management in the quarterly reportOutcomeCurrent until the next major version or a year

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.

  1. Start

    Staff must acknowledge the policies that apply to them

    An acknowledgement is a person's recorded confirmation that they have read a named version of a policy and will follow it. Auditors typically test review dates and acknowledgements first, sampling staff and one recent joiner.

    In the pack

  2. Step

    List the policies in force that need acknowledging

    Only policies are acknowledged individually, and only once they are approved and published. Standards and procedures are not acknowledged by everyone: the people who operate them are trained on them. A policy people sign without reading gives a false picture of acknowledgement, so keep policies short enough to read.

    In the pack

  3. Step

    Confirm who is in each policy's scope

    Include contractors, and the provider's staff who use your systems where the contract requires them to follow your policies, with the provider's account manager as their manager. In an NIS2 or DORA entity, management body members acknowledge too. Record leavers with a leaving date rather than deleting them.

    In the pack

    See also

  4. Decision

    What prompts the request?

    Three events start a request, each with its own window. A new minor version starts none: an acknowledgement stays current for every minor version of the same major version.

    In the pack

  5. Outcome

    No new acknowledgement needed

    An acknowledgement of version 2.1 is current for 2.2 but not for 3.0. On publication, still tell the people it applies to what changed and that they need not acknowledge it again. Do not restart the count.

    In the pack

    See also

  6. Step

    Ask for every applicable policy within the joiner window

    New starters, including contractors, acknowledge every policy that applies to them. The pack's default window is 10 working days from the start date. People who move role acknowledge any policy that newly applies within 10 working days of the move. Build it into onboarding through HR.

    In the pack

  7. Step

    Ask everyone in scope within 30 days of publication

    A new major version means a material change, so earlier acknowledgements no longer count and coverage restarts at zero. The pack's default window is 30 calendar days from publication, not approval. Send the requests on publication day, with a note of what changed and why.

    In the pack

  8. Step

    Open the annual cycle for every applicable policy

    Once a year, everyone acknowledges every policy that applies to them. A re-acknowledgement after a material change in the last 12 months counts as that year's acknowledgement of that policy, so nobody signs the same version twice in a year.

    In the pack

  9. Step

    Record a deliberate act: person, document, version, date

    Ticking a box or signing counts. Opening the file does not. Keep one record per acknowledgement and never overwrite it, with a note of where the evidence is held, such as the e-learning platform's export. In a small organisation a signed form or an email reply is enough if you record where it is filed.

    In the pack

  10. Step

    Remind people 5 working days before their deadline

    Remind everyone who has not yet acknowledged, before anyone becomes overdue. The 5 working days are the pack's default.

    In the pack

  11. Decision

    Did they acknowledge by the deadline?

    Overdue means past the deadline that applies: joiner, material change or annual. Record which one was missed, so each manager sees the reason next to the name.

    In the pack

  12. Step

    Name them to their line manager

    Send each manager a list of their own people who are overdue, with the policy, the rule missed and the days past the deadline. The line manager is the escalation point the pack names, because the manager can make it happen.

    In the pack

  13. Decision

    Is anyone still overdue?

    Every overdue acknowledgement goes in the quarterly report, named by manager. The pack's target is zero more than 30 days overdue. If you cannot tell from your records, treat the answer as yes: gaps in the record are gaps in the evidence.

    In the pack

  14. Outcome

    Report them to management in the quarterly report

    Name every manager with overdue acknowledgements in their team, count those more than 30 days overdue against the target, and show coverage for each policy against the pack's target of at least 95% of people in scope. State the decision management needs to take. Someone who repeatedly fails to acknowledge after reminders is handled under your disciplinary procedure, or the supplier's performance terms.

    In the pack

  15. Outcome

    Current until the next major version or a year

    The acknowledgement stays current for 12 months and through minor versions. It lapses when a new major version is published or the year runs out, and the cycle starts again.

    In the pack

Practical checklist

  1. List the approved, published policies that need acknowledging.
  2. Confirm who is in each policy's scope, and record leavers with a leaving date instead of deleting them.
  3. Ask joiners and people who move role to acknowledge every policy that newly applies to them within the joiner window.
  4. On the day a new major version is published, ask everyone in scope to acknowledge it within the change window, with a note of what changed and why.
  5. Open the annual cycle once a year for every policy that applies to each person.
  6. Record each acknowledgement as a deliberate act: person, document, version and date, never overwritten, with where the evidence is held.
  7. Remind everyone who has not acknowledged before their deadline, then send each line manager a list of their own overdue people, with the policy and the days past the deadline.
  8. Report coverage per policy and every manager with overdue acknowledgements to management each quarter, with the decision management needs to take.

Evidence to have ready

  • The acknowledgement records for a sample of staff and one recent joiner: person, document, version, date and where the evidence is held.
  • Coverage for each policy against the target, and the overdue list named by manager.
  • The quarterly reports and escalations, showing management knew and decided.
  • For each policy, the date its current major version was published, from which the change window runs.

Assumptions

  • You have an HR start date and a line manager for everyone in scope, and some way to record a deliberate acknowledgement: an e-learning platform, an intranet form, a signed form or an email reply.
  • The windows and targets shown are the defaults in the CISO Times policy pack. Your own framework may set different ones.

Not covered here