> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/campaigns/compliance-campaigns.md). # Compliance Campaigns Run structured compliance campaigns in Herd — bundle a framework, trainings, policies, and users into one trackable, audit-ready program. ## Overview The **Campaigns** page is a centralized hub for managing organizational compliance programs. It enables security and compliance teams to create structured campaigns, assign training and policy requirements to users, track completion progress, and maintain audit-ready records — all from a single interface. To open it, click **Campaigns** under **Manage** in the left-hand sidebar. (The row and page were called **Compliance** until recently; the link is unchanged, so old bookmarks still work.) ## The Campaigns page At the top of the Campaigns page, the **featured framework tiles** — **SOC 2**, **ISO 27001**, **HIPAA**, and **US HR training** — give you a one-click starting point. If your organization already has a campaign for that framework, the tile shows its status and links straight to it; if not, the tile offers **Create campaign** and opens the create form with that framework's template already picked. **US HR training** opens the [Harassment prevention (US, targeted)](/herd-security-docs/campaigns/compliance-campaigns/harassment-prevention.md) template, and shows only when HR trainings are enabled for your organization. HR trainings are an add-on: the first time you use HR trainings, choose **Accept** when Herd offers to turn them on for your organization, or reach out to your Herd team. Below the tiles, a table lists every campaign with its **Framework**, **Status**, **Due Date**, and **Created** date. Use the search box and the **Status** filter (All Statuses, Draft, Active, Paused, Completed, Cancelled) to find a campaign. ## Agentic Campaigns (let Herd AI build it) Next to **Create Campaign**, the Campaigns page has a **Start agentic campaign** button. Instead of assembling a campaign by hand, Herd AI builds an **ongoing** compliance campaign that runs until everyone is compliant — and you can pause it anytime. The wizard has three steps: 1. **Framework** — pick the framework and click **Generate plan**. Herd AI reviews your existing library against the framework's requirements. 2. **Review plan** — each proposed item carries a provenance badge: **Existing training** (already in your library), **From Herd catalog** (a copy will be added), or **Will be generated** (Herd AI creates it for you). Adjust before continuing. 3. **Audience & launch** — choose who's in scope, set the reminder cadence, and click **Launch campaign**. The **Auto-nudges** section of the last step controls reminders for the whole campaign: * **Automatic reminders**: a toggle (on by default) that keeps reminding assignees until they complete their items. * **Nudge frequency (days)**: how often each person is reminded, from 1 to 30 days. * **Completion window (days)**: how long each person has to complete an item before it needs attention. The nudge frequency can't be longer than the completion window; the wizard shows **Nudge frequency must be no longer than the completion window** and keeps **Launch campaign** disabled until you fix it. The resulting campaign is named after the framework (e.g. *SOC 2 Compliance (Herd AI)*) and shows an **Ongoing** mode label — it keeps working until everyone is compliant rather than expiring on a date. *** ## Creating a Compliance Campaign The core action on the Campaigns page is creating a Compliance Campaign. A campaign bundles together a compliance framework, associated trainings and tracks, policy acknowledgements, and assigned users into a single trackable program. ### Start from a template The create form opens with **Start from a template**. A template adds its trainings, tracks and policies, each with its due date and repeat schedule, and fills in the campaign's name, description and compliance framework. Pick one from the **Template** list, which groups **Your templates** and **Herd templates**. It includes templates that aren't tied to a named framework, such as **Harassment prevention (US, targeted)** (see [Harassment Prevention Training](/herd-security-docs/campaigns/compliance-campaigns/harassment-prevention.md)). Choose **No template** to start empty. An "Includes" panel under the picker lists each item. Expand a track (**Show trainings**) to see its trainings, click the edit icon to open an item, or click the remove icon to drop any item you don't want before creating the campaign. The edit and remove controls also appear on keyboard focus and on touch screens. You can add more items later from the campaign's detail page. * If a template has items that repeat and you've set an **End Date**, a note reminds you that repeating items only repeat in an ongoing campaign. * If a template includes Herd catalog content, a note explains that a copy is added to your organization's tracks and trainings when the campaign is created, so you can customize it without affecting the catalog. * The template picker is the only control that overwrites the form. If you've already made changes, switching templates asks first (**Replace your changes?**), and so does choosing **No template**, which drops the template's items but keeps your name, description and dates. * A featured framework tile's **Create campaign** opens the form with that framework's template already picked. ### Campaign Details #### Campaign Name A required field. A template suggests a name, but you can edit it to anything that clearly identifies the campaign, such as "SOC 2 Annual Compliance 2026" or "HIPAA Readiness Q2." #### Description An optional free-text field to describe the purpose, scope, and context of the campaign. A template suggests a description that you can keep or replace. #### Compliance Framework Select the regulatory or security framework that the campaign is aligned to from the **Compliance Framework** dropdown. The campaign's policy acknowledgements count toward this framework in compliance reports, and trainings tagged with the framework are added to its newest active campaign. Available options are: * SOC 2 * SOC 1 * ISO 27001 * ISO 42001 * NIST CSF * GDPR * HIPAA * PCI DSS * SOX * FISMA * FERPA * CMMC * CCPA/CPRA * FedRAMP * FDA 21 CFR Part 11 * CUI/FCI * Custom All of these frameworks are built in — you don't need to create them yourself. Choose **Custom** for internal initiatives that aren't tied to a named standard, or leave the field on "Select a framework (optional)" if the campaign isn't for a framework. {% hint style="info" %} While a template is picked, the framework is the template's and can't be changed here. Choose **No template** to pick a different framework. Picking a framework doesn't load or change a template. {% endhint %} #### Campaign Timeline Set the **Start Date** and **End Date** for the campaign. These default to **today** and **one month from today**, and you can change either. The dates define the active window during which users are expected to complete their assigned work and are used to determine overdue status. Every item's due date has to fall inside this window. When a template pre-fills items, any template due date that would land after your **End Date** is pulled back to the end date (items that already fit keep their own dates). When you add an item yourself or edit its due date later, a date in the past is rejected (**Due date can't be in the past**), and a date after the campaign end is rejected with a message naming the end date — **This campaign ended on \. Extend its end date before adding items.** — so you can either move the item or extend the campaign. The window is enforced the other way too: narrowing a campaign's dates so that existing items would fall outside them is blocked, with the stranded items and their due dates listed. #### Delivery Order Choose how each person receives the campaign's items: * **All at once** (the default): every item is sent as soon as the campaign starts. * **One after another**: each person gets the next item only after finishing the one before it. See [Sending items one after another](#sending-items-one-after-another). You can change the delivery order while the campaign is a draft (it appears as **Delivery order** on the detail page). Once the campaign is live it can't be changed, and a sequential campaign shows a **One item after another** badge. When you're ready, click **Create Campaign**. You'll land on the new campaign's detail page as a draft. ## The Campaign Detail Page A campaign opens to its detail page, which is organized into two tabs: * **Overview** — the dashboard, items, policies, and assigned users (described below). * **Nudges** — a **Reminder setup** roll-up of how each item reminds and escalates, followed by the per-campaign reminder history. See [Nudges](/herd-security-docs/campaigns/nudges.md) for details. ### Campaign Status Every campaign moves through a status lifecycle, shown as a badge next to the campaign name: **Draft → Active → Paused → Completed / Cancelled** The available action buttons depend on the current status: | **Status** | **Available actions** | | ---------- | ----------------------------------- | | Draft | **Activate**, **Delete** | | Active | **Pause**, **Complete**, **Delete** | | Paused | **Resume**, **Delete** | | Completed | (read-only) | | Cancelled | (read-only) | While a campaign is in Draft or Paused, its details, items, and assignments remain editable. Once a campaign is Completed or Cancelled, it becomes read-only. A paused campaign sends nothing. People who join a targeted group while it's paused are enrolled but not sent anything. When you resume a campaign set to **All at once**, Herd delivers what it still owes: to people who joined, and for items or groups you added, while it was paused. People who had already started an item are left to carry on. {% hint style="warning" %} **Setup Required before activation.** A draft campaign can't be activated until it has **at least one training or track** and **at least one assigned group**. Until both are in place, a "Setup Required" panel lists what's still missing and the **Activate** button stays disabled. {% endhint %} ### Summary Metrics Once a campaign leaves Draft, the dashboard displays four metric cards at the top. (These cards are hidden while the campaign is still a draft, since there's no progress to report yet.) | **Metric** | **Description** | | ----------- | ----------------------------------------------------------------- | | Total Users | The number of users enrolled in the campaign. | | Completed | The count of completed training or policy items across all users. | | In Progress | Items that have been started but not yet finished. | | Overdue | Items that have passed their due date without completion. | ### Overall Progress Below the metric cards, a completion rate is displayed as both a ratio and a percentage, giving a quick, high-level view of how the campaign is tracking. ## Trainings and Tracks The **Trainings and Tracks** section lists all training programs and tracks assigned as part of the campaign. Each entry shows: * Item name and type (TRAINING or TRACK) * Due date for completion (editable inline) * Audience — **Everyone in the campaign**, or the names of the groups and people the item is narrowed to (see [Per-item audiences](#per-item-audiences) below) * Progress — modules completed out of the total * Overdue count * Actions — such as removing the item Expand a track row to see the individual trainings inside it. Use **Add** to attach more trainings or tracks while the campaign is editable. The add dialog lists your whole library (not just the first page), minus anything already in the campaign, and you can search to narrow it. It includes a **Mandatory** toggle — assignments those items create are marked mandatory (for track items, trainings the track assigns later follow the track's own default instead). Once a campaign is non-draft, you can export this data with the **CSV** or **JSON** buttons for use in audits or external reporting. ### Per-item audiences By default every item goes to everyone in the campaign. When one training, track, or policy only applies to part of the campaign — a PCI module for Finance inside a company-wide SOC 2 campaign, say — narrow that item on its own without touching the campaign's audience. Click the item's audience to open the **Audience for \** dialog and choose: * **Everyone in the campaign** — includes groups and people added to the campaign later. * **Only specific groups and people** — search the campaign's groups and people and tick the ones to include. Until you tick at least one, the item still goes to everyone; once you have, the dialog reads *N selected — only they receive this*. Click **Save**. Narrowing requires the campaign to have groups assigned (the dialog says so otherwise). On a live campaign, people who leave an item's audience have their unfinished work for that item withdrawn — for a policy, a pending attestation is withdrawn while signed attestations are kept — and people who join it are asked to complete it now. ### Repeating items and new-joiner deadlines Each training, track and policy has a **Schedule** button that opens **Schedule for \**, with two optional fields (leave a field blank to turn it off): * **Repeat every N months** — after someone completes the item, it comes due for them again this many months later, and Herd re-assigns it automatically. Only ongoing campaigns (no **End Date**) can repeat an item. A policy that needs an evidence file asks for a new upload each cycle; earlier files and completion awards are kept, and the audit export shows which cycle each file belongs to. * **New joiners due within N days** — people who join after the campaign starts are due this many days after they join, instead of on the item's due date. Reminders, overdue counts and risk use each person's own due date. You can set both fields when adding an item, too. ### Sending items one after another On a campaign set to **One after another**, each person moves through the trainings, tracks and policies in order. The next item is sent only once they've completed the one before it: the training is finished, the track is finished (including any policies inside it), or the policy is signed. **Simulations aren't part of the sequence** and are sent as usual. * A **Delivery sequence** panel on the campaign page numbers the items in order, shows when each is due, and lists anything sent outside the sequence. * **Due dates count from when each person receives the item.** Instead of a fixed date, each item is due a number of days after it's sent (14 by default, between 1 and 365). Set it with **Due (days after it's sent)** when you add the item, or later in the item's **Schedule** dialog. Reminders, nudges and overdue counts all use each person's own due date. * An item that hasn't reached someone yet is never reminded or shown as overdue. On a person's policy cards it reads **Not sent yet**, and each card shows its place, such as **Item 2 of 5**. * When you add an item, **Place in sequence** puts it before any existing item or **At the end**. People who are already past that point won't receive it, and the dialog warns you when that's the case. An item added at the end still goes to people who have finished everything else. * If someone already completed a training, finished a track or signed a policy elsewhere, it counts as done when its turn comes and they move straight on. * People who join later start at the first item. You can reorder items on a live campaign: items not yet sent go out in the new order, and anything already sent stays with the person. When a large sequential campaign starts, Herd sends each person's first item in batches, so it can take a while for everyone to receive theirs. ### People no item covers When some people in the campaign have no work location, or no item's audience includes them, the campaign page shows a **Some people may get the wrong course, or none** callout naming them, with a **Review people without a work location** link. Add an item for everyone else, or widen an item's audience. ## Policy Acknowledgements Compliance campaigns can also require users to acknowledge organizational policies. Rather than a fixed list, you attach **any policies from your own library**. Click **Add Policy Acknowledgements** to open the modal. From there you: 1. Set a **due date** that will apply to the policies you select. 2. Search your policy library and check the policies you want to include. The list covers your entire library, not just the first page. 3. Click **Save** to attach them — or use **Create New** to author a brand-new policy without leaving the campaign. Each attached policy tracks acknowledgement progress (acknowledged vs. pending) across the assigned users, with its own due date and overdue status, and — like trainings and tracks — its own [audience](#per-item-audiences) when only some of the campaign needs to attest. You can drill into a policy to see the per-user **Policy Results**, which can be **exported to CSV**. Campaign policies are delivered the same way standalone policies are (Slack, then Teams, then an email magic link), and if a user has already acknowledged a policy, on its own or in an earlier campaign, the campaign counts it as complete on the original acknowledgement date instead of sending it again. See [Policies](/herd-security-docs/policies/policies.md#how-policies-reach-users-delivery-channels). {% hint style="info" %} Your policy library lives on the [Policies](/herd-security-docs/policies/policies.md) page. Any policy there — whether uploaded, linked (including Confluence pages), or auto-synced from OneDrive/SharePoint — can be attached to a campaign. {% endhint %} ## Users and Groups The Users and Groups section defines who is enrolled in the campaign. Teams can assign individual users or entire groups, making it easy to scope a campaign to a specific department, team, or the entire organization. (Remember: activating a campaign requires at least one assigned group.) To add groups, open the **Assign Herd Groups** dialog, search your Herd groups, and tick every one to add — the **Selected (N)** counter keeps track — then click **Assign groups** to add them all in one go. If the group you need doesn't exist yet, **Create New Group** opens the group dialog without leaving the campaign. Progress metrics (completed, in progress, overdue) are calculated based on the users and groups assigned here. ## Sending Reminders Reminders work two ways — automatically and on demand: * **Auto-nudge (on by default).** Every campaign item automatically reminds incomplete users by direct message (Slack or Teams). Herd checks every hour and sends each person's reminder during their own business hours, in their own time zone. For campaigns with an end date, reminders start **3 business days before** an item's due date, repeat **daily**, and stop **5 business days after** the due date. Ongoing (agentic) campaigns skip the due-date window and simply repeat on the cadence you chose at launch. The first reminder follows the same cadence counted from the day the person was assigned, so activating a campaign never messages people the same afternoon. * **Manual nudges.** From the campaign **Overview** you can nudge the users who haven't finished a specific training, track, or policy acknowledgement at any moment — no need to wait for the schedule. The campaign's **Nudges** tab opens with a **Reminder setup** table — one row per item, showing how its **Nudges** and **Escalations** are configured and linking to where each is edited — followed by the combined delivery history for automatic and manual nudges. {% hint style="info" %} Campaign-level nudge **notification delivery** is rolling out. When a nudge is recorded but notifications aren't sent yet, the toast reads **"Recorded nudge for N users (notifications coming soon)."** The nudge is always recorded for tracking, even when the notification itself hasn't been delivered. See [Nudges](/herd-security-docs/campaigns/nudges.md) for the full reminder workflow. {% endhint %} ## Summary The Campaigns page brings together everything needed to run a structured, trackable compliance program: | **Feature** | **Purpose** | | ----------------------- | ---------------------------------------------------------------------------------------------------------- | | Campaign Creation | Start from a template, then tailor the name, description, framework, and items. | | Status Lifecycle | Move a campaign through Draft → Active → Paused → Completed/Cancelled. | | Summary Metrics | Visibility into total users, completions, in-progress items, and overdue counts. | | Trainings & Tracks | Assign and monitor structured training programs with per-module tracking. | | Policy Acknowledgements | Attach any policies from your library and track acknowledgement with per-policy due dates. | | Users & Groups | Scope campaigns to specific individuals or teams, and narrow any single item to part of the campaign. | | Nudges | Automatic hourly-checked reminders in each person's business hours, manual nudges, and a delivery history. | | CSV / JSON Export | Download trainings/tracks data (CSV or JSON) and policy results (CSV) for audit evidence. | Together these features give security and compliance teams a single source of truth for tracking organizational compliance readiness across any framework.