Policy Acknowledgement (POL-002-R002) - POL-002

Requirement Details & Guidance

POL-002-R002 · POL-002

Why This Requirement Exists

To provide evidence that personnel received and acknowledged their responsibility to understand applicable security policies.

Implementation Guidance

Define which policies require acknowledgement; use an LMS, GRC, or policy platform to capture user, policy version, timestamp, and status; provide access to the policy before acknowledgement; handle non-completion through escalation.

Practical Application & Audit Readiness

POL-002-R002 · Field Guidance

Business Examples

Common Audit Findings

Common Mistakes

Best Practices & Ownership

POL-002 · Recommended Approach

Recommended Practices

Typical Owner

Cross-Mapped Regulatory Frameworks

Harmonized Control Mappings

FRAMEWORK CODE	FRAMEWORK NAME & DETAILS	FAMILY / CATEGORY	VERSION	ACTION
COBIT2019	COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO01 – Managed I&T Management Framework > APO01.09 – Define and communicate policies and procedures.	COBIT Governance Framework	v2019	View →
DORA	Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(4)(a) – Information security policy protecting availability, authenticity, integrity and confidentiality	EU Regulation	vCurrent	View →
GDPR	General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 32(4) – Personnel processing under authority	EU Regulation	vCurrent	View →
HIPAA	Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.316(a)(1) Policies and procedures documentation	US Law	vCurrent	View →
IRDAI	IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.5-IV – Review Frequency	India Guideline	vLatest	View →
ISO22301	ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 5.2.2 – Communicating the business continuity policy; 7.3 – Awareness; 7.4 – Communication	ISO Standard	v2019	View →
ISO27001	ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 5.2 – Policy	ISO Standard	v2022	View →
ISO27002	ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.1 – Policies for information security	ISO Standard	v2022	View →
NIS2	NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(g) – Basic cyber hygiene practices and cybersecurity training	EU Directive	vCurrent	View →
NIST-CSF	NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.PO – Policy \| GV.PO-01 – Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced	NIST Framework	v2	View →
NIST80053	NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.12 – PLANNING, 3.2 – AWARENESS AND TRAINING; PL-4 – RULES OF BEHAVIOR, AT-2 – LITERACY TRAINING AND AWARENESS	NIST Control Catalog	vRev. 5	View →
NPCI-ISR	NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Governance Controls; Policy, Roles and Risk Linkages – Trainings and awareness	India Standard	vLatest	View →
PCI-DSS	PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.1.1 – An overall information security policy is:	PCI Standard	v4	View →
RBI-CSF	RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §3 – Need for a Board approved Cyber-security Policy; Circular §18 – Cyber-security awareness among stakeholders / Top Management / Board; 23) User / Employee/ Management Awareness – 23.1 Security/acceptable-use policies communicated to users, employees, vendors and partners with cybersecurity education	India Regulation	vLatest	View →
SEBI-CSCRF	SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.3 GV.PO: Policy	India Regulation	vLatest	View →
SOC2	SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC2.2 – Information and Communication – COSO Principle 14: The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.	AICPA Audit Framework	vLatest	View →

Parent Domain Context

Governance Domain Baseline

Domain Name:

Policy & Document Management (POL)

Purpose:

To create, maintain, and manage the lifecycle of security and compliance policies, standards, and procedures.

Scope:

Enterprise

View

Parent Control Context

Control Baseline

Control Name:

Policy Communication & Awareness (POL-002)

Summary:

Establishes processes to communicate security policies to all personnel, ensuring awareness, understanding, acknowledgment, and compliance with organizational security requirements.

Business Description:

Ensure all employees and contractors are aware of relevant security policies and are trained on their responsibilities.

View