Currently, all employees sign our Information Security Agreement when they are hired signifying they have read our Employee Guide to Information Security and agree to the policies. All employees sign an Annual Acknowledgment as well. Last year, we implemented password policies on our Blackberry devices and due to an audit finding, we also get the new user to sign an Acknowledgment Form. Due to a stolen laptop issue, I was preparing to get all laptop user to sign another Acknowledgment Form. Does anyone have this many Acknowledgment Forms or shoudn't the one annual form suffice?

I would think that an annual for existing staff and an initial one for new hires would suffice. Combine it with Ethics. I personally hate to see us kill so many more trees than we need to, only to gripe about the filing. I'd also consider an electronic acknowledgment when available.