Lernoa Business
Start free trial

Worked example

One policy, start to finish.

A sample policy from a fictional company, the short course it becomes, the assessment, the sign-off and the record. Nothing to upload, nothing to sign up for.

Harbourline Freight is a fictional company. Every name, date and figure on this page is made up.

1 · The document

A four-page policy, uploaded as a PDF.

Information Security Policy Version 2 · 4 pages · PDF

3. Passwords and sign-in

  1. 3.1 Use a different password for every work account.
  2. 3.2 Turn on multi-factor authentication wherever it is offered.
  3. 3.3 Never share your password with anyone, including IT.
  4. 3.4 Lock your screen whenever you leave your desk.

4. Phishing and suspicious messages

  1. 4.1 Do not open attachments or links you were not expecting, even from a known sender.
  2. 4.2 Report a suspicious email the same day with the Report button in your mail app. Do not forward it.
2
Information Security Policy Version 2 · 4 pages · PDF

5. Devices and working away from the office

  1. 5.1 Only company-managed laptops may hold client data.
  2. 5.2 On any network Harbourline does not manage, use the VPN.
  3. 5.3 Report a lost or stolen device within 2 hours.

6. Reporting an incident

  1. 6.1 Report anything that might be a security incident to IT at once, even if you are not sure.
  2. 6.2 You will not be blamed for reporting a mistake. You may be for hiding one.
3

2 · The lesson

The chapter a learner reads.

Chapter 2 of 4 · 4 min

Passwords and sign-in

Source: policy section 3, page 2

Every work account gets its own password. If one website leaks it, the others stay safe. 3.1 · p. 2

Turn on multi-factor authentication wherever it is offered. It is the one setting that stops a stolen password from being enough. 3.2 · p. 2

Watch out

Nobody at Harbourline will ever ask for your password, not even IT. A request for it is something to report, not something to answer. 3.3 · p. 2

Lock your screen when you step away, even for a minute. 3.4 · p. 2

Check your understanding · practice, does not count

Someone from IT messages you asking for your password to fix a sync problem. What does the policy say?

  • Send it, since IT is allowed to ask
  • Send it after confirming they work here
  • Do not share it, and report the request Correct
  • Change it first, then send the new one

Section 3.3: never share your password with anyone, including IT. Section 6.1: report anything that might be an incident.

Practice questions give instant feedback and do not count. The final assessment does.

3 · Assessment and sign-off

Checked, then signed. Recorded separately.

Final assessment · 8 questions · pass mark 80%

Question 1

A supplier you were not expecting an invoice from sends one as an attachment. What does the policy ask you to do?

  • Open it to check whether it is genuine
  • Forward it to your manager to check
  • Report it with the Report button the same day, without forwarding it Correct
  • Delete it and carry on

Sections 4.1 and 4.2, page 2.

Question 5

Your laptop is stolen from your car at 6 pm on a Friday. By when must you report it?

  • On Monday morning Your answer
  • Within 2 hours Correct
  • Within a week
  • Only if it held client data

Section 5.3, page 3: within 2 hours, whatever the time or the day.

6 more questions

Passed 88% 7 of 8 correct · pass mark 80% · 1 attempt

Acknowledgement

I have read the Information Security Policy, version 2, and I understand that it applies to my work at Harbourline Freight.

Signed by Priya Natarajan

21 Apr 2027, 09:14

The acknowledgement is its own step with its own time. The assessment score does not stand in for it.

4 · The record

What the admin exports.

PersonTrainingVersionAssessmentAcknowledgedCertificate
Priya Natarajan Operations Information Security Policy v2 Passed · 88% · 21 Apr 2027 Missed: Q5, devices away from the office 21 Apr 2027, 09:14 Valid to 21 Apr 2028

Every completion, score and acknowledgement is tied to the version it was done on.

5 · Six months later

Six months later, the policy changes.

The reporting window for a lost device moves from 2 hours to 1 hour, and a new section on AI tools is added. Here is what the admin does and what the record shows afterwards.

  1. Upload version 3

    The new PDF goes in beside version 2. Both stay in the document history.

  2. Review the updated draft

    The draft is updated from the new document, with page references, and reviewed like the first time. Version 2 of the course is frozen as it was published.

  3. Choose what people must do

    Keep completions, re-acknowledge only, retake the assessment, or complete again. For this change: retake the assessment.

    • Keep completions
    • Re-acknowledge only
    • Retake the assessment
    • Complete again

  4. Assign, and let the reminders chase

    Everyone is re-enrolled on version 3 with a due date. Reminders go out in working hours and escalate to the team lead when someone is late.

Person Version Status Acknowledged Note
Priya Natarajan v3 Assigned · due 12 Nov 2027 Not yet New row
Priya Natarajan v2 Passed · 88% · 21 Apr 2027 21 Apr 2027, 09:14 Unchanged

The version 2 record is not edited, moved or overwritten. Anyone who asks later can see what Priya acknowledged in April, and what she was asked to do in November.

Ask, in one exchange

Learners can ask a question of the training they have. Answers come from that text only, cite the chapter and the page, and say so when the answer is not there. Managers never see anyone's Ask history.

Do I have to use the VPN at a client's office?

Yes. On any network Harbourline does not manage, use the VPN. A client's office network counts.

Chapter 4 · policy section 5.2, page 3

Can I use my own phone for work email?

This policy does not say. It covers client data on laptops (section 5.1) but not phones or email. Ask IT.

Not covered by the training

What this page is, and is not

  • The company, the people and the dates are invented. The policy is a short example written for this page.
  • The lesson, questions and record are a hand-written example of the shape of the output, to show what you get and how a source reference, a score and a sign-off sit in the record.
  • In your workspace the draft is written by AI from your own document, with page references. You review it, change what you like and publish it. Nothing reaches staff until you do.

Now try it with your own policy.

Start a free 14-day trial and upload one of your own documents. The lesson, the assessment, the sign-off and the record, exactly as on this page, with your words.

Start free trial See pricing