Does your organization have a formal process to ensure personnel are aware of, acknowledge, and comply with security policies relevant to their roles?

Policy awareness and accountability are what's under review: whether you have a formal way to ensure personnel know, acknowledge, and follow the security policies tied to their roles. Effective security awareness programs ensure employees understand what security policies apply to them and how they should implement them in their daily work activities.

Evidence could include: signed security policy acknowledgment forms, role-specific security training completion records, security awareness program documentation, or a security policy management system that tracks employee acknowledgments and periodic re-certifications of understanding.