Security training · Policy acknowledgement

Read, understood and proven.

A signature at the bottom of a policy proves nothing if nobody read it. CompliLens times the reading, checks understanding and records exactly who acknowledged which version, so the proof holds up in any audit.

Acceptable Use Policy · v4Assigned to you
20sminimum reading time

Try it: the button waits for 20 seconds of reading.

How it works

Seven steps from publish to proof

The whole flow runs by itself once a policy is published. Scroll to follow it.

1

Publish

A policy is approved and published. Acknowledgement starts the same moment.

2

Assign

People are assigned by department, role or the whole company, with a due date.

3

Read

The policy opens in a clean reader. Reading time is tracked, and the button stays locked until the minimum is reached.

4

Check

Two or three questions confirm the key rules were understood, not just scrolled past.

5

Acknowledge

The person confirms. The time, version and reading time are recorded.

6

Remind

Reminders go out before and after the due date, then escalate to the manager.

7

Prove

Every acknowledgement is filed as evidence against the policy and the controls it supports.

Version-aware

When a policy changes, people read the change

Re-reading a 20-page policy for one new paragraph is how acknowledgement turns into box-ticking. CompliLens shows each person what changed since the version they last acknowledged, and asks them to confirm that.

  • Changed sections highlighted for each reader
  • Only the people affected are asked again
  • The full history kept for every version
POL-HR-004 · v3 → v4
What changed since you last acknowledged1 section
4.2 Remote access: passwords must be at least 8 characters at least 12 characters, and multi-factor sign-in is required on every device.
Re-acknowledgement requested from200 people
126 confirmed in the first 48 hours
Completion at a glance

Who has acknowledged what, by policy and team

Acceptable Use Policy v496%
Information Security Policy92%
Data Protection Policy88%
Remote Working Policy74%
Code of Conduct 202661%
Engineering98%
Finance95%
Sales87%
Support79%
Operations68%
The evidence

A log auditors trust

Every row is timestamped, tied to a person and a policy version, and exported in one click.

app / policies / acknowledgements
WhenPersonPolicyVersionReading timeCheck
9 Nov 10:42Aisha KapoorAcceptable Use Policyv43m 12s3 / 3
9 Nov 10:15Ravi DasAcceptable Use Policyv42m 48s3 / 3
8 Nov 17:03Sana MenonData Protection Policyv25m 31s2 / 3
8 Nov 09:20Kiran RaoCode of Conduct 2026v17m 04s3 / 3
Attestation campaigns

Yearly sign-offs, run as one campaign

Annual policy pack

Bundle the policies everyone must re-confirm each year into one campaign with one due date.

  • One link per employee
  • Progress by team
  • Escalation to managers

Code of conduct

Collect a yearly attestation with your own wording and questions.

  • Custom statements
  • Free-text declarations
  • Exportable register

Confidentiality and NDAs

Ask new joiners and contractors to accept confidentiality terms before access is granted.

  • Linked to onboarding
  • Contractor support
  • Expiry reminders
Questions

Acknowledgement, answered

Can people just wait out the timer?

The timer is a minimum, not proof on its own. A short comprehension check confirms the key rules were understood, and both results are recorded.

What happens when a policy is updated?

People who acknowledged an earlier version are asked to read and confirm only what changed, and the history of every version is kept.

Does it work for contractors?

Yes. Contractors can be invited with access limited to their own policies and training.

Where does the evidence go?

Each acknowledgement is filed against the policy and the controls it supports, and appears in the Evidence Repository and audit exports.

Keep exploring

The rest of security training

Curriculum

Fourteen core topics in short, scenario-based lessons, with tracks for each role.

Explore

Knowledge assessment

Adaptive tests show what each person really knows, topic by topic.

Explore

Attack simulation

Realistic phishing, smishing, vishing, QR, MFA-fatigue and deepfake tests.

Explore