Acknowledge: Security Awareness and Training Procedure

Purpose

This Procedure describes how we make sure that everyone at Tidewell IT knows the risks of their work and the rules that apply, from the first weeks of employment and through the years that follow.

Scope

It applies to all employees, contractors, and interns, and to members of the Management Board.

Roles

• HR Lead: owns this Procedure, plans the sessions, and keeps the records.
• ISMS Manager: supplies the content and reports on results.
• Service Desk Lead: runs the phishing simulation.
• Line managers: make time for training and follow up with their teams.
• Management Board: attends its own annual session.

Procedure

Induction

1. Every starter completes induction awareness in the first 2 weeks. It covers the Information Security Policy, the Acceptable Use Policy, how to report an event, and the handling of customer data.
2. The HR Lead books the session when the start is announced, and records the completion.

Annual refresher

1. Everyone completes a refresher every year. The content changes with the incidents, Findings, and new threats of the year before.
2. The ISMS Manager approves the content, and the HR Lead schedules the sessions so that everyone is reached.

Role-specific training

1. A training matrix in the Training register states which training each role needs, for example secure development for engineers or data subject requests for the Service Desk.
2. The HR Lead compares the matrix with the records every quarter and plans the missing training.

Phishing simulation

1. The Service Desk Lead runs a phishing simulation every quarter, with scenarios that change from one quarter to the next.
2. A person who reports the message is thanked. A person who clicks gets coaching in a short, friendly session.
3. A person who clicks repeatedly gets more coaching from the line manager. The simulation is for learning and not for blame.

Management Board

1. Every year the Management Board attends a session on cyber risk, in line with the duty of board members under the Cbw. The ISMS Manager prepares it and the HR Lead records attendance.

Records and targets

1. The HR Lead keeps the record of every session, with the date, the content, and the attendees.
2. The target is a completion rate of 95 percent for each mandatory course. The HR Lead reports the rate every quarter to the ISMS Manager, and line managers follow up with those who have not completed.

Records

• The Training register with the matrix and the completions.
• The induction and refresher attendance lists.
• The quarterly phishing results and the completion report.

Related documents

• Human Resources Security Policy
• Information Security Policy
• Joiner, Mover and Leaver Procedure

Review

The HR Lead reviews this Procedure at least once a year and after a significant change.