The organisation should have a procedure for training and guidance of its personnel. These procedures should include and cover at least the following topics:
- Information security policies.
- Reporting of security incidents.
- Response to malware incidents.
- User account and login information policies (e.g., password policies).
- Compliance with information security regulations.
- Use of non-disclosure agreements (NDAs) when sharing sensitive information.
- Use of external IT services.
The training program should identify specific groups of employees who require this training, such as administrators, those with access to customer networks, and manufacturing personnel.
The training concept must be approved by responsible management. Conduct training and awareness programs regularly and in response to specific events. Ensure that employees know who to contact for information security concerns.
