Cyber hygiene and training

Catalog reference

Make sure your staff and the other people who work in the entity, as far as relevant to their function, are aware of the risks to the entity's network and information systems and apply cyber hygiene practices (art. 12(1)). Designate the staff and other people whose roles, responsibilities and authorities require skills and expertise in the security of network and information systems, and make sure they receive regular training on that security (art. 12(2)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Narrative — how we satisfy this requirement