Do you require new employees to fill out agreements and review policies?

This question is asking whether your organization has a formal process requiring new employees to read, understand, and acknowledge company policies and sign relevant agreements when they join the company. These typically include confidentiality agreements, acceptable use policies, security policies, code of conduct, and other employment-related documents. Why this is asked in security assessments: 1. Accountability: Signed agreements create a record that employees were informed of their responsibilities. 2. Legal protection: These agreements establish the employer-employee relationship regarding handling of sensitive data and systems. 3. Security awareness: The process ensures employees are aware of security expectations from day one. 4. Compliance requirements: Many regulations (like HIPAA, SOC2, ISO 27001) require documented evidence that employees understand their security obligations. The question helps assessors understand if your organization has baseline security awareness measures in place and if you're creating accountability for security practices at the employee level. Without such agreements, it's difficult to enforce security policies or take action if violations occur. When answering this question, you should: - Be specific about which agreements and policies are required - Mention when in the onboarding process these are reviewed (ideally before system access is granted) - Note if you track completion and maintain records of these signed documents - Mention if there are consequences for non-completion