A transit authority wants every employee to confirm they read the acceptable-use policy. Which lifecycle approach fits this awareness need?
Select an answer to reveal the explanation.
Short Explanation
Reading a policy is a people checkbox, not a packet capture. Acknowledgment campaigns and attestations collect human confirmation. Save technical control tests for systems and processes that need operational evidence.
Full Explanation
Awareness that every employee read the acceptable-use policy is typically satisfied with a policy acknowledgment or attestation campaign aimed at employees, distinct from technical control testing. A transit authority should not confuse human acknowledgment with technical control tests against firewall rules for each employee account, nor with risk assessments scored on inherent likelihood for each reader, nor with one shared issue ticket assigned to all employees as watchers. Those alternatives either test the wrong layer, invent an impossible mass risk-assessment workload, or misuse issues as a broadcast channel that does not prove individual acknowledgment. Exam caveat: acknowledgment campaigns prove distribution and receipt—they do not replace technical controls that enforce acceptable use on systems and networks. Operational check: publish the acceptable-use policy to active status, launch an acknowledgment campaign to the employee population, track completion rates by department, escalate non-responders through managers, and retain completion evidence for auditors. Keep technical AUP-related controls on system entities on their own testing calendar so civic awareness and technical enforcement both remain visible in IRM reporting used by transit leadership.