What Certaria asks of you

Who this is for: everyone. You do not administer anything, you have not been given a new system to learn, and you need no new software.

The short version: occasionally you will be asked to read a document and confirm you have read it. That is almost all of it.

Why you are being asked

Your organisation is working towards ISO 27001, an international standard for keeping information secure. Part of the standard is being able to show that the people who work here know the rules, rather than just that the rules exist somewhere.

That is what your confirmation is for. It is not a test, and nobody is checking whether you agreed with the document. It records that you were given it and had the chance to read it.

The messages you will get

Everything reaches you in Microsoft Teams and email. You need nothing beyond the Microsoft 365 account you already sign in with.

Message	When	What to do
New policies published	When your organisation publishes or updates documents	Read them and confirm, when you have a moment
A reminder	Daily, only while you still have something outstanding	The same. It stops as soon as you confirm
Your tasks	Daily, only if you have been given tasks	Look at what is due
Anything to report?	Daily, if your organisation switched it on	Usually nothing. Say so by ignoring it
Training expiring	Before your security training runs out	Book a refresher

The reminders stop on their own

The daily reminder only goes to people who still have something outstanding. If you confirm what you have been sent, you stop hearing from it. There is no way to be nagged about something you have already done, unless a new version has been issued.

Reading and confirming a policy

1. Open the link in the message, or go to your organisation’s ISMS site and open Published Policies.
2. Open the document and read it.
3. Use the Acknowledge link beside it.

That is the whole procedure. Your confirmation is recorded within the hour, and the reminders stop.

If a document is reissued, you will be asked again

When a document is updated to a new version, everyone is asked to confirm the new one, including people who confirmed the old one. That is deliberate: a confirmation records that you read a specific version, so it cannot carry over to a document that now says something different.

It is not an error, and it does not mean your earlier confirmation was lost.

Reporting something

If you notice something that worries you, a lost laptop, an email that looks wrong, a document shared with the wrong person, use Report a concern on the same site.

Report it even if you are not sure. Nothing here is a formal accusation, and a concern that turns out to be nothing costs a minute to close. Something noticed and not reported is the expensive one.

What other people can see

This is the question most people actually have, so it is answered plainly.

• Your concerns are yours. You can see the concerns you have raised. Other staff cannot see them. The people who administer the ISMS can, because somebody has to act on them.
• Your confirmations are visible to your ISMS administrators. That is their purpose: they are the record your organisation shows an auditor. They show that you confirmed a document and when. They do not record whether you read it carefully, how long you spent, or what you thought of it.
• Nothing you do here is monitored beyond that. Certaria reads your organisation’s security settings, not your files, your messages or your browsing.

If you have the Certaria assistant

Some organisations add a Certaria assistant to Teams. If yours has, you can ask it things in plain English, such as what a policy requires or what you still have outstanding, and you can confirm a policy in the conversation instead of on the site. Both routes record exactly the same thing.

If you have never seen it, your organisation has not added it, and nothing above depends on it.

If something is not working

Tell whoever administers the ISMS at your organisation. Two things are worth mentioning to them, because they are the usual causes:

• You are getting no messages at all while colleagues are. Your account may not be linked to your record.
• You confirmed something but are still being reminded. Give it an hour. If it continues, say so.