Skip to content

Policy Acknowledgement Form

Purpose. Records that each person has read and accepted Soon's security policies. Several policies state that staff acknowledge them; until now no form existed to do it with. Satisfies A.5.4 (management responsibilities), A.6.3 (awareness) and SOC 2 CC1.1 / CC2.2.

Completed at onboarding and once a year afterwards. The annual round pairs naturally with /isms:onboard, which also writes the training log — one sitting, two pieces of evidence.

Acknowledgement

Name: ___ Role: ___ Date: ______

I confirm that I have read, understood and agree to follow:

Document Read
1 Information Security Policy — how Soon approaches security and why ☐
2 Acceptable Use Policy — including the rules on AI tools ☐
3 HR Security Policy — expectations and consequences ☐
4 Access Control Policy — least privilege, passwords, MFA ☐
5 Device Security Standard — the baseline for the device I work on ☐
6 Remote Working Policy ☐
7 Event Reporting Procedure — how and when to report ☐
8 Clear Desk & Clear Screen Policy ☐

I also confirm that I understand:

  • ☐ Customer personal data is not mine to browse. I access it only where there is a genuine operational reason.
  • ☐ No secrets and no customer personal data go into AI tools.
  • ☐ Credentials live in Enpass — never in files, notes, chat or code.
  • ☐ I report anything suspicious immediately, through Slack #Security or security@soon.works — including where I caused it. Reporting a mistake quickly is treated as doing the right thing, not as something to be in trouble for.
  • ☐ I know who to ask when I am unsure: Olaf, as Information Security Manager.

Signature: ____

Administration
Who Everyone with access to Soon systems — founders, employees, contractors, and external consultants with repo or system access
When At onboarding, then annually; and again after any material policy change
Where filed Google Drive → HR records
Also recorded in Training & Awareness Log

Chasing this is the whole job. A form nobody signs is worse than no form, because the gap is now documented. Run it as one round for everyone rather than person by person.

Change log

Version Date Author Comments
0.1 2026-08-22 ISMS First version — several policies referenced an acknowledgement that had never been created.