Skip to main content
Acknowledgment Campaigns let you send one or more Policies to employees for review and digital acknowledgment. Each recipient gets a unique link, reviews the policies, and electronically signs off. Regentra timestamps and records every sign-off, creating audit-defensible evidence that employees read and accepted your security, privacy, and compliance policies.

​
What you can do

  • Create campaigns — Select policies and recipients, set a due date
  • Send for signature — Employees receive personalized emails with a link to sign
  • Track completion — Monitor who has opened, signed, and who’s pending or overdue
  • Tie to policy versions — Each campaign is linked to specific policy versions; if a policy changes, create a new campaign for re-acknowledgment
  • Generate audit evidence — The recipient-level sent/opened/completed record proves your workforce understood and agreed to your policies

​
How to send a policy campaign

1

Open Policy Campaigns

In the Compliance module sidebar, click Campaigns.
2

Click New Campaign

Choose a name (e.g. “Security Policy 2026 Sign-Off”) and optional description.
3

Select policies to include

Check the boxes for the policies (or specific policy versions) you want to send. Common picks: Information Security Policy, Acceptable Use Policy, Incident Response Policy, Data Privacy Policy.
4

Choose recipients

Build your recipient list from your Entra-synced workforce roster:
  • All workforce users — a single toggle for everyone
  • Groups — target specific Microsoft Entra security groups, marking each as Include or Exclude so you can, for example, target one department while excluding a sub-team within it
  • Individuals — add or exclude specific people; service/shared-mailbox accounts are excluded automatically unless you explicitly turn them on
  • Add manually — add a name and email directly, for recipients outside the synced roster
5

Set a due date

Pick the date by which you need all acknowledgments — typically 2-4 weeks from send date.
6

Send the campaign

Click Send Campaign. The system emails each recipient a personalized link.

​
Campaign status lifecycle

​
Recipient flow

Each recipient gets an email with a unique, secure link. When they click:
  1. View policies — they read each policy included in the campaign
  2. Confirm understanding — a checkbox or button confirms they’ve read and understand
  3. Sign — they electronically sign and submit
  4. Confirmation — they see a confirmation page with timestamp and receipt
The system records sent / opened / completed timestamps to the second.

​
Linking acknowledgments to policy versions

Each campaign is tied to the specific policy version current when you sent it. If you update the policy later, the old acknowledgments remain tied to the old version — showing auditors that sign-offs were collected for the language in effect at that time. To get new acknowledgments after a policy change:
  1. Publish the updated policy version
  2. Create a new campaign with the new version
  3. Send to the same (or different) recipients
This builds a clear chain of evidence: Policy v1 → Acknowledgments (Jan) → Policy v2 → Acknowledgments (Apr).

​
Reviewing acknowledgment records

1

Open the campaign

In the Compliance module sidebar, click Campaigns and select the campaign name.
2

Review the recipient list

Each recipient row shows sent, opened, and completed timestamps — this is the full record for the campaign, viewable directly on the page.
3

Document the evidence

There’s no built-in export for this report today. If you need a standalone artifact for an audit package, document the campaign (a screenshot or a written summary of the recipient list) and attach it to the relevant control in Evidence Collection.
Signed acknowledgments should be treated as immutable records — auditors verify the integrity of your evidence.

​
Best practices

  1. Plan ahead — send campaigns 4-6 weeks before audit so you have time to follow up on stragglers
  2. Set realistic due dates — give employees 2-4 weeks; many will procrastinate
  3. Send reminders — when due date is a week away, ping unsigned recipients
  4. Document non-compliance — if someone refuses to sign, escalate and document the exception
  5. Archive evidence — after the campaign closes, document the recipient list for your audit package

​
Frequently asked questions

Yes. Filter recipients by department, location, role, or upload a custom list — useful for targeted policy updates.
Their status shows Pending or Overdue. Send a reminder email. If they still don’t sign, document the exception and escalate.
You can update the policy content, but the campaign remains tied to the version it was sent with. Existing sign-offs are locked to that version. New campaigns will use the new version.
Yes for most frameworks (SOC 2, ISO 27001, HIPAA). If you need advanced e-signatures, you can integrate DocuSign or similar.
Typically 6 years. Store in your secure archive and reference during audits.