Blog · Policy training · Problem 29 of 93
Your team signed the policies without reading them. Make them listen instead.
· 3 min read · By Case Jones
You own security, people or compliance, and every employee has acknowledged the policies. You also know most of them scrolled to the bottom and clicked.
What it costs to leave it
An acknowledgement nobody read gives you a record and no protection. People still share passwords, click the odd link and do not know who to call when a laptop goes missing. When something goes wrong, a signed policy the person never understood is a weak defense, and auditors ask for training records as well.
How to get policies read, and prove it
People skip policies because they are long, dry and arrive all at once. Change the format and the timing and more of it sticks.
- 1
Pick the five rules that matter most
Most policies carry a handful of rules every employee must know. Report a lost device right away, use the password manager, never share customer data outside approved tools, and so on. Lead with those and make them easy to repeat.
- 2
Use a format people can take in while doing something else
Few people will read a twenty-page PDF, but many will listen to ten minutes on a commute or a walk. Audio, short quizzes and real examples from your own company hold attention far better than a wall of text.
- 3
Check understanding with a few questions
A short quiz after each policy tells you who took it in. Keep the questions practical, like what you would do if you got a text from the CEO asking for gift cards. Low scores show you which part to explain again.
- 4
Spread it out and tie it to moments
Give new hires a deadline a couple of weeks after they start, once they know what the rules apply to. When a policy changes, ask people to go over just the change. A yearly refresh keeps it current.
- 5
Keep a record that shows more than a click
For each person, keep which version they acknowledged, when, and some sign they engaged with it, like how much they heard or their quiz score. That record answers both the auditor and the harder question of whether the training worked.
Or turn each policy into something people listen to
Training in 93 Compliance turns each of your policies into a short audiobook, spoken or sung, and a set of study games. It is written only from your document, so it teaches your rules and nothing else. Employees listen in the 93 app or on the web.
For each employee you get how much they heard, which version they acknowledged and when, and their game time and scores. You set requirements and deadlines for onboarding and for policy changes, and reminders go out automatically. Reports come out as CSV or PDF, and training records and acknowledgements go into the audit package.
Training is the paid part of 93 Compliance. It costs $10 per employee per year, so $500 a year for 50 people. Teams of 5 to 1,000 pay the same per person. The policy builder and everything else stay free.
- Each policy as a short audiobook, spoken or sung
- Study games written only from your documents
- Per-employee record of listening, acknowledgement and scores
- Onboarding and change deadlines with automatic reminders
- CSV and PDF training reports
See the training record
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Is a policy acknowledgement enough for SOC 2?
Auditors commonly look for evidence that employees acknowledged the policies and completed security awareness training, with dates. What counts as enough is up to your auditor, so ask them. A record that shows engagement as well as a signature is easier to defend.
How much does 93 Compliance training cost?
$10 per employee per year. A team of 50 pays $500 a year, and the price per person is the same from 5 to 1,000 people. The rest of 93 Compliance is free.
Does the training use generic security content?
No. The audiobook and games are written only from your own policy, so people learn your rules. If the policy changes, the training follows the new version.
How often should employees redo policy training?
Once at onboarding, again when a policy changes, and a yearly refresh is common. Shorter, more frequent touches tend to stick better than one long session.