Skip to main content
Xoxoday Empuls requires every employee to formally acknowledge that they have read and understood the information security policy and related procedures both at onboarding and at least once every year, with completion tracked by HR and InfoSec.
Security policy acknowledgement is a foundational control in any mature information security programme. Xoxoday Empuls formalises this through a structured, trackable process that applies to every employee from their first day. At onboarding, every new hire is required to read and formally attest that they understand the Xoxoday information security policy and its associated procedures. This attestation is logged and tracked by the HR and InfoSec teams, creating an auditable record that supports compliance with frameworks such as ISO 27001 and SOC 2 Type II. Annual acknowledgement cycles ensure that employees remain current with any policy updates throughout their tenure. Because information security requirements evolve — whether in response to new threat vectors, changes in regulation, or infrastructure updates — a one-time acknowledgement at onboarding is insufficient. Xoxoday Empuls addresses this by mandating a minimum annual re-attestation for all staff. The acknowledgement process is delivered through mandatory security awareness training. Employees complete assigned training modules and confirm via a tracked digital attestation that they have reviewed and understood the current policy. Integration with HR systems such as Workday, SAP SuccessFactors, or Darwinbox allows completion records to flow directly into employee profiles, giving HR and InfoSec a single source of truth for compliance reporting. For organisations evaluating Xoxoday Empuls as a vendor, this practice directly supports third-party risk assessment requirements. Auditors reviewing SOC 2 Type II reports or conducting ISO 27001 vendor assessments will find documented evidence that workforce security awareness is a managed, recurring control with clear ownership — not a one-off exercise. Notifications for upcoming or overdue attestations surface via collaboration tools such as Slack or Microsoft Teams, reducing operational overhead on HR teams while maintaining high completion rates. All attestation records are retained in line with Xoxoday’s data retention policy and are available for audit on request. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Does Empuls provide information security awareness training?

Learn how Xoxoday Empuls delivers and tracks mandatory security awareness training across the entire workforce.

Is Empuls ISO 27001 and SOC 2 certified?

Understand the compliance certifications and independent audits that underpin the Xoxoday Empuls security programme.