Awareness and security training

Catalog reference

Make sure staff, the management body and direct suppliers and service providers know the risks, understand why cybersecurity matters, and follow cyber hygiene practices. Run a recurring awareness programme that follows your security policies, covers relevant threats, your measures, contact points and further guidance, and user hygiene practices, test whether it works, and keep it current. Identify the staff whose duties need security skills, and give them a training programme matched to their roles that covers secure configuration and operation of systems (mobile devices included), known cyber threats, and what to do when a security event occurs. Assess how effective the training is, train staff who move to roles needing security skills, and update and repeat the programme. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Narrative — how we satisfy this requirement