The difference between a policy and a law is that ignorance of a policy is an acceptable defense. For a policy to become enforceable, what are the five criteria it must meet?

Question

What will be an ideal response?

Answer 1

For a policy to become enforceable, it must meet the following five requirements:

1) Dissemination (distribution)-The organization must be able to demonstrate that the relevant policy has been made readily available for review by the employee. Common dissemination techniques include hard copy and electronic distribution.

2) Review (reading)-The organization must be able to demonstrate that it disseminated the document in an intelligible form, including versions for illiterate, non-English-reading, and reading-impaired employees. Common techniques include recordings of the policy in English and alternate languages.

3) Comprehension (understanding)-The organization must be able to demonstrate that the employee understood the requirements and content of the policy. Common techniques include quizzes and other assessments.

4) Compliance (agreement)-The organization must be able to demonstrate that the employee agrees to comply with the policy, through act or affirmation. Common techniques include logon banners that require a specific action (mouse click or keystroke) to acknowledge agreement or a signed document clearly indicating that the employee has read, understood, and agreed to comply with the policy. Organizations can make acceptance of the policy a requirement and may choose to block access for those employees that choose to balk at such approval, which could lead to termination of the employees if they are unable to perform their duties without such access.

5) Uniform enforcement-The organization must be able to demonstrate that the policy has been uniformly enforced, regardless of employee status or assignment.