Policy Attestation & Acknowledgement Tracker

Records who has acknowledged which policy version, which is the evidence auditors ask for and the one most organisations cannot produce.

Available soon

Format: Excel
Size: 237 KB
Length: 14 sheets
Version: 1.0
Updated: 28 Sep 2026

What's inside

Instructions
People
Policies
Acknowledgement Log
Status
Summary
Overdue by Manager
Calculations
Lists
Definitions
Framework References

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Set the As-at date on the Summary sheet. The EXAMPLE uses 2026-09-30; replace it with today's date, or type =TODAY() to keep it current. Every status and deadline is measured against it.
2	Delete the EXAMPLE rows on the People, Policies and Acknowledgement Log sheets, and the EXAMPLE figures in the two yellow population columns on the Policies sheet, before you enter your own.
3	Policies sheet: list each policy people must acknowledge — Policy-tier documents in force, from the Policy Register & Review Schedule (up to 12). Enter the version in force and the date its current major version was published (the date 3.0 was published, for version 3.2): the re-acknowledgement window starts at publication, not approval. Applies to is "All staff" or one department's name exactly as it appears on the People sheet.
4	People sheet: one row per person who must acknowledge (up to 100), with a unique Person ID, their manager and start date. Enter a Leaving date when someone leaves rather than deleting the row: they drop out of scope from that date. Joiner deadline is 10 working days after the start date (PF-09).
5	Acknowledgement Log: one row per acknowledgement, never overwritten — Person ID, Document ref, the version acknowledged, the date, how it was recorded and where the evidence is (for example the e-learning platform's export). Paste your platform's export here if it has these columns.
6	Status sheet: calculated. For each person and policy: Current (the current major version acknowledged within the last 12 months); Outdated version (only an earlier major version acknowledged, and the 30-day window to re-acknowledge is still open); Not yet due (nothing yet, still within the joiner or change window); Overdue (past the joiner, change or annual deadline); Not in scope.
7	A minor version (2.0 to 2.1) does not need a new acknowledgement: an acknowledgement stays current for later minor versions of the same major version. A new major version (3.0) is a material change: everyone in scope re-acknowledges within 30 calendar days of its publication (approved 5 November and published 9 November: by 9 December).
8	Chase every Overdue on the Overdue by Manager sheet through the person's manager. PM-04's target is zero older than 30 days.
9	Each quarter, take PM-03 and PM-04 from the Summary to the quarterly report (PF-12), or paste the Summary's per-policy table and the overdue list into the Policy Health & Attestation Reporting Workbook.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

The EXAMPLE is a software services company with 240 staff in two offices, an NIS2 important entity, as at 2026-09-30. Its 4 policies requiring acknowledgement are ISP-001, AUP-001, ACP-001, INC-001, from the same register as the Policy Register & Review Schedule. SUP-001 is a policy too, but awaiting approval, so nobody acknowledges it yet.

How the EXAMPLE shows 240 people without inventing 240 names: the People sheet lists a named sample of 12 fictional staff, whose statuses are calculated in full. The totals for everyone — people in scope and current acknowledgements per policy — are typed into the two yellow 'whole population' columns on the Policies sheet, as they would be from an e-learning platform's report. The Summary reports those totals when they are entered and the calculated counts when they are blank. PM-03 uses the reported totals; PM-04 and the Overdue by Manager list can only name the people listed individually — in the EXAMPLE, the sample.

When you list everyone on the People sheet, leave the two population columns blank: every figure then comes from the individual rows.

Working days exclude weekends only. If your joiner window should skip public holidays, extend the Joiner deadline formula with a holiday list.

Tailoring — small organisation: list everyone; with a few dozen people the tracker replaces the paper forms. A signed form or a reply to an email is enough evidence if you record where it is filed.

Tailoring — regulated entity (NIS2, DORA): management body members acknowledge too, and cybersecurity training is required of them (NIS2 Art 20(2)); keep the log as the record of who was told of each policy change, and freeze a quarter-end copy for supervisors.

Tailoring — IT run by a service provider: list the provider's staff who have access to your systems if your contract requires them to follow your policies, with the provider's account manager as their Manager, so their overdue acknowledgements reach someone who can act.

People

One row per person who must acknowledge policies. EXAMPLE: a named sample of 12 of the example organisation's 240 staff.

Example	Person ID	Name	Role	Department	Manager	Start date	In scope at as-at date	Joiner deadline	Joiner	Notes
EXAMPLE	P-0001	Anna Kowalski	Head of Engineering	Engineering	Chief Operating Officer	1 Apr 2019	Yes	15 Apr 2019
EXAMPLE	P-0002	Daniel Reyes	Software Engineer	Engineering	Anna Kowalski	14 Jun 2021	Yes	28 Jun 2021
EXAMPLE	P-0003	Sofia Lindqvist	Software Engineer	Engineering	Anna Kowalski	6 Feb 2023	Yes	20 Feb 2023
EXAMPLE	P-0004	Liam O'Connor	DevOps Engineer	Engineering	Anna Kowalski	2 Sep 2024	Yes	16 Sep 2024
EXAMPLE	P-0005	Mei Tanaka	Graduate Engineer	Engineering	Anna Kowalski	21 Sep 2026	Yes	5 Oct 2026	In joiner window	New starter
EXAMPLE	P-0006	Mark Ellison	Head of Customer Services	Customer Services	Chief Operating Officer	5 Nov 2018	Yes	19 Nov 2018
EXAMPLE	P-0007	Chloe Martin	Customer Support Agent	Customer Services	Mark Ellison	10 Mar 2025	Yes	24 Mar 2025
EXAMPLE	P-0008	Jamal Ahmed	Customer Support Agent	Customer Services	Mark Ellison	24 Aug 2026	Yes	7 Sep 2026		New starter
EXAMPLE	P-0009	Grace Adeyemi	Finance Manager	Finance	Chief Operating Officer	13 Jan 2020	Yes	27 Jan 2020
EXAMPLE	P-0010	Oliver Brandt	Accounts Assistant	Finance	Grace Adeyemi	3 May 2022	Yes	17 May 2022
EXAMPLE	P-0011	Hannah Weiss	HR Adviser	HR	HR Director	20 Sep 2021	Yes	4 Oct 2021
EXAMPLE	P-0012	Ravi Menon	Sales Executive	Sales	Head of Sales	15 Jan 2024	Yes	29 Jan 2024

Policies

The Policy-tier documents people must acknowledge, from the Policy Register & Review Schedule. Up to 12; each has a column on the Status sheet.

Example	Document ref	Title	Version in force	Current major version published on	Applies to	Whole population in scope (enter only if not all listed)	Whole population current (enter only if not all listed)	Re-acknowledge by, after the major version
EXAMPLE	ISP-001	Information Security Policy	3.0	16 Mar 2026	All staff	240	231	15 Apr 2026
EXAMPLE	AUP-001	Acceptable Use Policy	2.1	5 Jun 2024	All staff	240	214	5 Jul 2024
EXAMPLE	ACP-001	Access Control Policy	2.0	22 Jan 2026	All staff	240	229	21 Feb 2026
EXAMPLE	INC-001	Incident Management Policy	1.2	8 May 2024	All staff	240	233	7 Jun 2024

Acknowledgement Log

One row per acknowledgement, kept as the record. Never overwrite a row: a new acknowledgement is a new row. Yellow columns are inputs.

Example	Person ID	Name	Document ref	Version acknowledged	Date acknowledged	Method	Evidence reference	Same major version as in force	Date for calculation
EXAMPLE	P-0007	Chloe Martin	ACP-001	1.3	12 Mar 2025	Signed form	Induction pack, HR file	No	12 Mar 2025
EXAMPLE	P-0012	Ravi Menon	AUP-001	2.0	2 Jun 2025	Intranet click-through	Intranet acknowledgement report	Yes	2 Jun 2025
EXAMPLE	P-0002	Daniel Reyes	AUP-001	2.1	15 Jul 2025	Intranet click-through	Intranet acknowledgement report	Yes	15 Jul 2025
EXAMPLE	P-0004	Liam O'Connor	ISP-001	2.2	10 Sep 2025	E-learning platform	LMS export 2025-09	No	10 Sep 2025
EXAMPLE	P-0010	Oliver Brandt	AUP-001	2.1	25 Sep 2025	E-learning platform	LMS export 2025-09	Yes	25 Sep 2025
EXAMPLE	P-0011	Hannah Weiss	INC-001	1.1	10 Nov 2025	E-learning platform	LMS export 2025-11	Yes	10 Nov 2025
EXAMPLE	P-0001	Anna Kowalski	ACP-001	2.0	26 Jan 2026	E-learning platform	LMS export 2026-02	Yes	26 Jan 2026
EXAMPLE	P-0002	Daniel Reyes	ACP-001	2.0	27 Jan 2026	E-learning platform	LMS export 2026-02	Yes	27 Jan 2026
EXAMPLE	P-0003	Sofia Lindqvist	ACP-001	2.0	28 Jan 2026	E-learning platform	LMS export 2026-02	Yes	28 Jan 2026
EXAMPLE	P-0004	Liam O'Connor	ACP-001	2.0	29 Jan 2026	E-learning platform	LMS export 2026-02	Yes	29 Jan 2026
EXAMPLE	P-0006	Mark Ellison	ACP-001	2.0	30 Jan 2026	E-learning platform	LMS export 2026-02	Yes	30 Jan 2026
EXAMPLE	P-0009	Grace Adeyemi	ACP-001	2.0	26 Jan 2026	E-learning platform	LMS export 2026-02	Yes	26 Jan 2026
EXAMPLE	P-0010	Oliver Brandt	ACP-001	2.0	27 Jan 2026	E-learning platform	LMS export 2026-02	Yes	27 Jan 2026
EXAMPLE	P-0011	Hannah Weiss	ACP-001	2.0	28 Jan 2026	E-learning platform	LMS export 2026-02	Yes	28 Jan 2026
EXAMPLE	P-0012	Ravi Menon	ACP-001	2.0	29 Jan 2026	E-learning platform	LMS export 2026-02	Yes	29 Jan 2026
EXAMPLE	P-0001	Anna Kowalski	ISP-001	3.0	16 Mar 2026	E-learning platform	LMS export 2026-03	Yes	16 Mar 2026
EXAMPLE	P-0002	Daniel Reyes	ISP-001	3.0	17 Mar 2026	E-learning platform	LMS export 2026-03	Yes	17 Mar 2026
EXAMPLE	P-0003	Sofia Lindqvist	ISP-001	3.0	18 Mar 2026	E-learning platform	LMS export 2026-03	Yes	18 Mar 2026
EXAMPLE	P-0006	Mark Ellison	ISP-001	3.0	19 Mar 2026	E-learning platform	LMS export 2026-03	Yes	19 Mar 2026
EXAMPLE	P-0007	Chloe Martin	ISP-001	3.0	20 Mar 2026	E-learning platform	LMS export 2026-03	Yes	20 Mar 2026
EXAMPLE	P-0009	Grace Adeyemi	ISP-001	3.0	16 Mar 2026	E-learning platform	LMS export 2026-03	Yes	16 Mar 2026
EXAMPLE	P-0010	Oliver Brandt	ISP-001	3.0	17 Mar 2026	E-learning platform	LMS export 2026-03	Yes	17 Mar 2026
EXAMPLE	P-0011	Hannah Weiss	ISP-001	3.0	18 Mar 2026	E-learning platform	LMS export 2026-03	Yes	18 Mar 2026
EXAMPLE	P-0012	Ravi Menon	ISP-001	3.0	19 Mar 2026	E-learning platform	LMS export 2026-03	Yes	19 Mar 2026
EXAMPLE	P-0001	Anna Kowalski	AUP-001	2.1	16 Mar 2026	E-learning platform	LMS export 2026-03	Yes	16 Mar 2026
EXAMPLE	P-0003	Sofia Lindqvist	AUP-001	2.1	17 Mar 2026	E-learning platform	LMS export 2026-03	Yes	17 Mar 2026
EXAMPLE	P-0004	Liam O'Connor	AUP-001	2.1	18 Mar 2026	E-learning platform	LMS export 2026-03	Yes	18 Mar 2026
EXAMPLE	P-0006	Mark Ellison	AUP-001	2.1	19 Mar 2026	E-learning platform	LMS export 2026-03	Yes	19 Mar 2026
EXAMPLE	P-0007	Chloe Martin	AUP-001	2.1	20 Mar 2026	E-learning platform	LMS export 2026-03	Yes	20 Mar 2026
EXAMPLE	P-0009	Grace Adeyemi	AUP-001	2.1	16 Mar 2026	E-learning platform	LMS export 2026-03	Yes	16 Mar 2026
EXAMPLE	P-0011	Hannah Weiss	AUP-001	2.1	17 Mar 2026	E-learning platform	LMS export 2026-03	Yes	17 Mar 2026
EXAMPLE	P-0001	Anna Kowalski	INC-001	1.2	11 May 2026	E-learning platform	LMS export 2026-05	Yes	11 May 2026
EXAMPLE	P-0002	Daniel Reyes	INC-001	1.2	12 May 2026	E-learning platform	LMS export 2026-05	Yes	12 May 2026
EXAMPLE	P-0003	Sofia Lindqvist	INC-001	1.2	13 May 2026	E-learning platform	LMS export 2026-05	Yes	13 May 2026
EXAMPLE	P-0004	Liam O'Connor	INC-001	1.2	14 May 2026	E-learning platform	LMS export 2026-05	Yes	14 May 2026
EXAMPLE	P-0006	Mark Ellison	INC-001	1.2	15 May 2026	E-learning platform	LMS export 2026-05	Yes	15 May 2026
EXAMPLE	P-0007	Chloe Martin	INC-001	1.2	11 May 2026	E-learning platform	LMS export 2026-05	Yes	11 May 2026
EXAMPLE	P-0009	Grace Adeyemi	INC-001	1.2	12 May 2026	E-learning platform	LMS export 2026-05	Yes	12 May 2026
EXAMPLE	P-0010	Oliver Brandt	INC-001	1.2	13 May 2026	E-learning platform	LMS export 2026-05	Yes	13 May 2026
EXAMPLE	P-0012	Ravi Menon	INC-001	1.2	14 May 2026	E-learning platform	LMS export 2026-05	Yes	14 May 2026
EXAMPLE	P-0008	Jamal Ahmed	ISP-001	3.0	26 Aug 2026	E-learning platform	LMS export 2026-08	Yes	26 Aug 2026
EXAMPLE	P-0008	Jamal Ahmed	ACP-001	2.0	26 Aug 2026	E-learning platform	LMS export 2026-08	Yes	26 Aug 2026
EXAMPLE	P-0008	Jamal Ahmed	INC-001	1.2	26 Aug 2026	E-learning platform	LMS export 2026-08	Yes	26 Aug 2026
EXAMPLE	P-0005	Mei Tanaka	ISP-001	3.0	22 Sep 2026	E-learning platform	LMS export 2026-09	Yes	22 Sep 2026
EXAMPLE	P-0005	Mei Tanaka	AUP-001	2.1	22 Sep 2026	E-learning platform	LMS export 2026-09	Yes	22 Sep 2026

Status

Acknowledgement status — every person against every policy

Calculated at the As-at date on the Summary sheet. Read along a row for one person, down a column for one policy. The colour only repeats the word. Do not type here.

Person ID	Name	Manager	ISP-001 v3.0	AUP-001 v2.1	ACP-001 v2.0	INC-001 v1.2	Overdue (count)	Longest overdue (days)	Overdue more than 30 days
P-0001	Anna Kowalski	Chief Operating Officer	Current	Current	Current	Current
P-0002	Daniel Reyes	Anna Kowalski	Current	Overdue	Current	Current	1	77	1
P-0003	Sofia Lindqvist	Anna Kowalski	Current	Current	Current	Current
P-0004	Liam O'Connor	Anna Kowalski	Overdue	Current	Current	Current	1	168	1
P-0005	Mei Tanaka	Anna Kowalski	Current	Current	Not yet due	Not yet due
P-0006	Mark Ellison	Chief Operating Officer	Current	Current	Current	Current
P-0007	Chloe Martin	Mark Ellison	Current	Current	Overdue	Current	1	221	1
P-0008	Jamal Ahmed	Mark Ellison	Current	Overdue	Current	Current	1	23
P-0009	Grace Adeyemi	Chief Operating Officer	Current	Current	Current	Current
P-0010	Oliver Brandt	Grace Adeyemi	Current	Overdue	Current	Current	1	5
P-0011	Hannah Weiss	HR Director	Current	Current	Current	Current
P-0012	Ravi Menon	Head of Sales	Current	Overdue	Current	Current	1	120	1

Summary

Acknowledgement summary

Calculated from the People, Policies and Acknowledgement Log sheets as at the date shown. PM-03 and PM-04 are two of the four headline measures reported every quarter (PF-12); the other two come from the Policy Register & Review Schedule.

As-at date	30 Sep 2026	EXAMPLE as-at date: replace with today's date, or type =TODAY()
Joiner window (working days)	10	From the Policy Framework Standard (PF-09). Change only if your Standard does.
Re-acknowledge after a new major version (calendar days)	30	From the Policy Framework Standard (PF-09). Change only if your Standard does.
Coverage target	95%	From the Policy Framework Standard (PM-03). Change only if your Standard does.
Overdue older than (calendar days)	30	From the Policy Framework Standard (PM-04). Change only if your Standard does.

Acknowledgement by policy

Document ref	Title	Version	Listed: in scope	Listed: current	Listed: not yet due	Listed: overdue	Listed: overdue more than 30 days	Reported: in scope	Reported: current	Reported: coverage	Status
ISP-001	Information Security Policy	3.0	12	11	0	1	1	240	231	96.3%	Met
AUP-001	Acceptable Use Policy	2.1	12	8	0	4	2	240	214	89.2%	Below target
ACP-001	Access Control Policy	2.0	12	10	1	1	1	240	229	95.4%	Met
INC-001	Incident Management Policy	1.2	12	11	1	0	0	240	233	97.1%	Met

All policies

960

907

94.5%

Below target

Listed: the people on the People sheet. Reported: the whole-population totals from the Policies sheet where entered, otherwise the listed figures. Coverage uses the reported figures.

Headline measures

Measure	Result	Target	Status	What it means
PM-03 Acknowledgement coverage	94.5%	≥ 95%	Below target	Acknowledged person-and-policy pairs ÷ in-scope pairs, across Policy-tier documents that require acknowledgement. Reported figures, all policies above.
PM-04 Overdue acknowledgements: older than 30 days	4	Zero older than 30 days	Action needed	People past their joiner, change or annual deadline, named by manager. Counts people listed individually; named on the Overdue by Manager sheet.
all overdue acknowledgements	6	—		Person-and-policy pairs past their deadline, however recently.

Quarterly acknowledgement review

Item		Entry
Reviewed by		[[Name, role]]
Review date		[[YYYY-MM-DD]]
Managers chased, and by when		[[e.g. Anna Kowalski and Mark Ellison: all overdue acknowledgements by 2026-10-16]]
Policies below the coverage target, and the plan		[[e.g. AUP-001: reminder to everyone not current; version 3.0 campaign after approval]]

Overdue by Manager

Overdue acknowledgements by manager (PM-04)

Everyone listed on the People sheet with at least one overdue acknowledgement, sorted by manager and then name, as at the As-at date. Send each manager their rows. PM-04's target: zero older than 30 days.

No.	Manager	Name	Role	Policies overdue	Overdue (count)	Longest overdue (days)	Overdue more than 30 days (count)	Manager's people overdue
1	Anna Kowalski	Daniel Reyes	Software Engineer	AUP-001 (annual, 77 days)	1	77	1	2
2	Anna Kowalski	Liam O'Connor	DevOps Engineer	ISP-001 (material change, 168 days)	1	168	1
3	Grace Adeyemi	Oliver Brandt	Accounts Assistant	AUP-001 (annual, 5 days)	1	5		1
4	Head of Sales	Ravi Menon	Sales Executive	AUP-001 (annual, 120 days)	1	120	1	1
5	Mark Ellison	Chloe Martin	Customer Support Agent	ACP-001 (material change, 221 days)	1	221	1	2
6	Mark Ellison	Jamal Ahmed	Customer Support Agent	AUP-001 (joiner, 23 days)	1	23

Policies overdue shows each policy with the rule missed (joiner, material change or annual) and days past the deadline.

Calculations

Calculations — used by the Status, Summary and Overdue by Manager sheets. Do not type here.

Latest acknowledgement of the current major version

Person ID	ISP-001	AUP-001	ACP-001	INC-001
P-0001	16 Mar 2026	16 Mar 2026	26 Jan 2026	11 May 2026
P-0002	17 Mar 2026	15 Jul 2025	27 Jan 2026	12 May 2026
P-0003	18 Mar 2026	17 Mar 2026	28 Jan 2026	13 May 2026
P-0004		18 Mar 2026	29 Jan 2026	14 May 2026
P-0005	22 Sep 2026	22 Sep 2026
P-0006	19 Mar 2026	19 Mar 2026	30 Jan 2026	15 May 2026
P-0007	20 Mar 2026	20 Mar 2026		11 May 2026
P-0008	26 Aug 2026		26 Aug 2026	26 Aug 2026
P-0009	16 Mar 2026	16 Mar 2026	26 Jan 2026	12 May 2026
P-0010	17 Mar 2026	25 Sep 2025	27 Jan 2026	13 May 2026
P-0011	18 Mar 2026	17 Mar 2026	28 Jan 2026	10 Nov 2025
P-0012	19 Mar 2026	2 Jun 2025	29 Jan 2026	14 May 2026

Latest acknowledgement of any version

Person ID	ISP-001	AUP-001	ACP-001	INC-001
P-0001	16 Mar 2026	16 Mar 2026	26 Jan 2026	11 May 2026
P-0002	17 Mar 2026	15 Jul 2025	27 Jan 2026	12 May 2026
P-0003	18 Mar 2026	17 Mar 2026	28 Jan 2026	13 May 2026
P-0004	10 Sep 2025	18 Mar 2026	29 Jan 2026	14 May 2026
P-0005	22 Sep 2026	22 Sep 2026
P-0006	19 Mar 2026	19 Mar 2026	30 Jan 2026	15 May 2026
P-0007	20 Mar 2026	20 Mar 2026	12 Mar 2025	11 May 2026
P-0008	26 Aug 2026		26 Aug 2026	26 Aug 2026
P-0009	16 Mar 2026	16 Mar 2026	26 Jan 2026	12 May 2026
P-0010	17 Mar 2026	25 Sep 2025	27 Jan 2026	13 May 2026
P-0011	18 Mar 2026	17 Mar 2026	28 Jan 2026	10 Nov 2025
P-0012	19 Mar 2026	2 Jun 2025	29 Jan 2026	14 May 2026

Deadline

Person ID	ISP-001	AUP-001	ACP-001	INC-001
P-0001	16 Mar 2027	16 Mar 2027	26 Jan 2027	11 May 2027
P-0002	17 Mar 2027	15 Jul 2026	27 Jan 2027	12 May 2027
P-0003	18 Mar 2027	17 Mar 2027	28 Jan 2027	13 May 2027
P-0004	15 Apr 2026	18 Mar 2027	29 Jan 2027	14 May 2027
P-0005	22 Sep 2027	22 Sep 2027	5 Oct 2026	5 Oct 2026
P-0006	19 Mar 2027	19 Mar 2027	30 Jan 2027	15 May 2027
P-0007	20 Mar 2027	20 Mar 2027	21 Feb 2026	11 May 2027
P-0008	26 Aug 2027	7 Sep 2026	26 Aug 2027	26 Aug 2027
P-0009	16 Mar 2027	16 Mar 2027	26 Jan 2027	12 May 2027
P-0010	17 Mar 2027	25 Sep 2026	27 Jan 2027	13 May 2027
P-0011	18 Mar 2027	17 Mar 2027	28 Jan 2027	10 Nov 2026
P-0012	19 Mar 2027	2 Jun 2026	29 Jan 2027	14 May 2027

Days overdue

Person ID			ISP-001	AUP-001	ACP-001	INC-001

P-0001

P-0002

P-0003

P-0004

168

P-0005

P-0006

P-0007					221
P-0008				23

P-0009

P-0010

P-0011

P-0012

120

Reason overdue

Person ID			ISP-001	AUP-001	ACP-001	INC-001

P-0001

P-0002

Annual

P-0003

P-0004

Material change

P-0005

P-0006

P-0007					Material change
P-0008				Joiner

P-0009

P-0010

Annual

P-0011

P-0012

Annual

Per person: overdue list order and detail

Person ID	Overdue (count)	Sort key	Rank	Policies overdue
P-0001	0
P-0002	1	Anna Kowalski \| Daniel Reyes \| P-0002	1	AUP-001 (annual, 77 days)
P-0003	0
P-0004	1	Anna Kowalski \| Liam O'Connor \| P-0004	2	ISP-001 (material change, 168 days)
P-0005	0
P-0006	0
P-0007	1	Mark Ellison \| Chloe Martin \| P-0007	5	ACP-001 (material change, 221 days)
P-0008	1	Mark Ellison \| Jamal Ahmed \| P-0008	6	AUP-001 (joiner, 23 days)
P-0009	0
P-0010	1	Grace Adeyemi \| Oliver Brandt \| P-0010	3	AUP-001 (annual, 5 days)
P-0011	0
P-0012	1	Head of Sales \| Ravi Menon \| P-0012	4	AUP-001 (annual, 120 days)

Lists

AckMethod	AckStatus	OverdueReason	YesNo
E-learning platform	Current	Joiner	Yes
Intranet click-through	Outdated version	Material change	No
Signed form	Not yet due	Annual
Email reply	Overdue

Not in scope

Definitions

Definitions

Term	Meaning in this workbook
Acknowledgement	A person's recorded confirmation that they have read a policy and will follow it, for a named version on a named date (PF-09: people acknowledge the policies that apply to them: new starters within the joiner window, everyone again after a material change and once a year.).
Policies requiring acknowledgement	Documents of the Policy tier that are in force. Standards, procedures and guidelines are followed by the people whose work they cover and are not acknowledged individually.
Major and minor version	The number before the point is the major version (3 in 3.2). A new major version is a material change and needs a new acknowledgement; a minor version does not.
Current major version published on	The date the x.0 version of the version in force was published (not approved). The re-acknowledgement window runs from it (PF-08, PF-09): a policy approved on 5 November and published on 9 November must be re-acknowledged by 9 December.
Current	The person has acknowledged the current major version, and did so within the last 12 months.
Outdated version	The person has acknowledged only an earlier major version, and the 30-calendar-day window to re-acknowledge is still open.
Not yet due	The person has acknowledged nothing yet and is still within their joiner window (10 working days from the start date) or the change window.
Overdue	Past the deadline that applies: joiner (no acknowledgement within the joiner window), material change (no acknowledgement of the new major version within the change window) or annual (the last acknowledgement is more than 12 months old).
Not in scope	The policy does not apply to the person (another department), or they have not started or have left at the As-at date.
Deadline	The date by which the person must acknowledge: 12 months after their last acknowledgement of the current major version; otherwise the joiner deadline for someone who started after the major version was published; otherwise the change deadline or the anniversary of their last acknowledgement, whichever is earlier.
Joiner deadline	10 working days (Monday to Friday) after the start date.
Whole population columns	Totals typed from another system when not everyone is listed on the People sheet. When blank, the Summary uses the listed figures.
PM-03 Acknowledgement coverage	People in scope with a current acknowledgement of each policy that applies to them, as a share of all people in scope. Counted as: Acknowledged person-and-policy pairs ÷ in-scope pairs, across Policy-tier documents that require acknowledgement. Target ≥ 95%.
PM-04 Overdue acknowledgements	People past their joiner, change or annual deadline, named by manager. Target: zero older than 30 days.
As-at date	The date every status is calculated at. Set on the Summary sheet.
PF-nn, PM-nn	Rule and measure numbers in the Policy Framework Standard.
EXAMPLE row	A worked example: a sample of the example organisation's staff as at 2026-09-30. Delete before approval.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 7.3 — Awareness	The tracker as a whole: people made aware of the policy and their part in it, with evidence
ISO/IEC 27001:2022	Annex A 6.3 — Information security awareness, education and training	Joiner, change and annual acknowledgement deadlines; Overdue by Manager
ISO/IEC 27001:2022	Annex A 5.1 — Policies for information security	Policies communicated to and acknowledged by relevant personnel: Acknowledgement Log, Status
NIST CSF 2.0	PR.AT-01 — “Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind”	Acknowledgement of each policy that applies to a person, renewed every year
NIS2 — Directive (EU) 2022/2555	Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training”	Acknowledgement as part of basic cyber hygiene and training; PM-03 coverage

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Delegated Regulation (EU) 2024/1774