The entity subject to information security self-monitoring must have a training plan or a corresponding document describing the operational model for staff induction, training, and the maintenance, monitoring, and verification of up-to-date competence in the processing of client data, as well as in data protection and information security topics.
The training plan must describe the content and implementation methods of the training required for various tasks and roles.
The training and competence required of information system users can be verified with certificates, records of participation in training, or in another manner agreed upon within the organization.