Under Req 12.6.2, how must personnel acknowledge understanding of the security policy and procedures, at least annually?

Under Req 12.6.2, how must personnel acknowledge understanding of the security policy and procedures, at least annually?

• A. Only at hire
• B. In writing or electronically, at least annually
• C. Biannually
• D. Not required

Answer: (B)

Formal acknowledgment of understanding security policies creates a documented record that personnel have read and understand the rules they must follow. The requirement specifies that this acknowledgment be done in writing or electronically and occur at least once every year. This approach provides audit-ready evidence that staff are aware of the policies and procedures and supports accountability, while also ensuring that updates to policies are formally recognized by the workforce. If acknowledgment were only done at hire, or on a biannual basis, there would be gaps in awareness and weaker coverage for policy changes. Declaring that acknowledgment is not required would ignore a fundamental control for policy enforcement. Therefore, the correct practice is to require written or electronic acknowledgment at least annually.

Formal acknowledgment of understanding security policies creates a documented record that personnel have read and understand the rules they must follow. The requirement specifies that this acknowledgment be done in writing or electronically and occur at least once every year. This approach provides audit-ready evidence that staff are aware of the policies and procedures and supports accountability, while also ensuring that updates to policies are formally recognized by the workforce. If acknowledgment were only done at hire, or on a biannual basis, there would be gaps in awareness and weaker coverage for policy changes. Declaring that acknowledgment is not required would ignore a fundamental control for policy enforcement. Therefore, the correct practice is to require written or electronic acknowledgment at least annually.