Skip to main content
Xoxoday Empuls requires every employee, contractor, agency temp, and relevant third party to formally acknowledge and adhere to its published security and data protection policies as a condition of accessing or handling SPAR information.
Security policy acknowledgment is a foundational element of responsible data governance. Xoxoday Empuls treats this as a mandatory step, not an optional formality—every individual who accesses or handles SPAR information must formally confirm their understanding of and commitment to the organisation’s published security and data protection policies. Who Must Acknowledge Xoxoday Empuls extends this requirement across the entire access population. Permanent employees, fixed-term contractors, agency temporary staff, and any third-party vendors or partners who interact with SPAR data must all provide formal acknowledgment before access is granted. There are no carve-outs based on engagement type, seniority level, or the duration of an assignment. How the Requirement Is Enforced Acknowledgment obligations are built into three reinforcing layers. Contractual terms establish the baseline: employment agreements and vendor contracts explicitly require compliance with Xoxoday Empuls security and data protection policies before system access is provisioned. Onboarding workflows then formalise this as a step-by-step attestation, where new hires and contractors confirm in writing that they have read, understood, and agreed to adhere to current policies. Periodic re-attestation ensures that acknowledgments remain valid as policies are updated or individuals transition into roles with different access privileges. Organisations running HR lifecycle management through Workday or SAP SuccessFactors can align these attestation workflows with existing onboarding and compliance checkpoints, creating a unified audit trail without duplicating administrative effort. Standards Alignment This practice reflects controls required by internationally recognised security frameworks. ISO 27001 Annex A.7 (Human Resource Security) and SOC 2 Type II Common Criteria CC1.4 and CC9.2 both mandate that personnel understand and accept their information security responsibilities. By documenting acknowledgments at the point of onboarding and revalidating them periodically, Xoxoday Empuls helps your organisation satisfy auditor requirements and demonstrate a mature, evidence-based security posture to enterprise customers and regulators. Training as a Reinforcing Layer Written acknowledgment confirms intent; training builds capability. Xoxoday Empuls supplements policy attestations with periodic security awareness training, ensuring employees and contractors understand the specific behaviours expected of them—not just that policies exist. Training completion records are maintained alongside attestation logs, giving security and compliance teams a consolidated view of workforce readiness. For distributed teams using Slack or Microsoft Teams, training reminders and re-attestation prompts can be delivered directly within the collaboration tools employees rely on daily, improving completion rates without adding friction to existing workflows. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Does Xoxoday Empuls have a GDPR-aligned privacy policy?

Understand how Xoxoday Empuls handles personal and sensitive data, including the policies and controls that govern data collection, storage, and processing.

Does Xoxoday Empuls have ISO 27001, SOC 2, and GDPR compliance?

Explore the ISO 27001 and SOC 2 Type II certifications that underpin Xoxoday Empuls security controls and what they mean for your organisation’s risk posture.