Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Staff guidance and training procedure in cyber security

Critical
High
Normal
Low

Our organization has defined procedures for maintaining staff's cyber security awareness.These may include e.g. the following things:

  • staff receive instructions describing the general guidelines of digital security related to their job role
  • staff receive training to maintain the appropriate digital and cyber security skills and knowledge required for the job role
  • staff demonstrate through tests that they have the security skills and knowledge required for the job role

Training should focus on the most relevant security aspects for each job role and include often enough the basics, which concern all employees:

  • employee's personal security responsibilities (e.g. for devices and processed data)
  • policies relevant for everyone (e.g. security incident reporting)
  • guidelines relevant for everyone (e.g. clean desk)
  • organization's security roles (who to contact with problems)
Connected other frameworks and requirements:
T11: Turvallisuuskoulutus ja -tietoisuus
2 luku, 4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
29. Processing under the authority of the controller or processor
GDPR
32. Security of processing
GDPR
7.2.1: Management responsibilities
ISO 27001

Unit- or role-specific security guidelines

Critical
High
Normal
Low

The security guidelines are specified in connection with the employee's job role. The organization has identified units and roles that require separate guidance and develops its own detailed security guidelines for these.

Examples of units that may require their own guidelines are e.g. customer service, IT and HR. Examples of work roles that require their own instructions are the system administrators and the remote workers.

Connected other frameworks and requirements:
7.2.2: Information security awareness, education and training
ISO 27001
2 luku, 4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
PR.AT-1: Awareness
NIST CSF
6.3: Information security awareness, education and training
ISO 27001

Maintaining a log of cyber security trainings

Critical
High
Normal
Low

A log is kept of the cyber security training events provided by the organization to its staff. The log can be used to show what kind of specific investments the organization has made towards staff's cyber security expertise.

For each training the documentation should include:

  • Time
  • Topics and duration of the training
  • Training method and trainer
  • Staff involved in the training
Connected other frameworks and requirements:
T11: Turvallisuuskoulutus ja -tietoisuus
7.2.2: Information security awareness, education and training
ISO 27001
PR.AT-1: Awareness
NIST CSF
6.3: Information security awareness, education and training
ISO 27001
8.4 (MIL1): Develop Cybersecurity Workforce
C2M2

Continuous development of guidelines

Critical
High
Normal
Low

If staff have conflicting goals with the security guidelines, they are unlikely to follow the guidelines.

The organization actively seeks to find poorly functioning guidelines and modify either the guidelines, tools or staff priorities to enable following the guidelines.

Connected other frameworks and requirements:
12.1.1: Documented operating procedures
ISO 27001
T11: Turvallisuuskoulutus ja -tietoisuus
5.37: Documented operating procedures
ISO 27001
6.3: Information security awareness, education and training
ISO 27001

Evaluating the efficiency of arranged training

Critical
High
Normal
Low

The effectiveness of cyber security training is regularly evaluated. The evaluation may include e.g. the following perspectives:

  • Is the competence of the staff deep enough?
  • Are the training methods and amounts correct?
  • Are different units trained in the right things?
  • Is the staff motivated to learn?
  • Does the staff understand the reasons for the training (e.g. what kind of negative effects can a cyber security breach have?


Connected other frameworks and requirements:
7.2.2: Information security awareness, education and training
ISO 27001
6.3: Information security awareness, education and training
ISO 27001
No items found.