Train Workforce Members on Authentication Best Practices

The organization has predefined authentication methods that employees should prefer when using data systems.

When using cloud services, the user can often freely decide how he or she authenticates with the service. A single centralized authentication account (such as a Google or Microsoft 365 account) can help close a large number of access rights at once when the main user account that acts as the authentication method is closed.

The organization should have defined guidelines for the generally acceptable use of data systems and for the management of the necessary credentials.

In addition, the owners of data systems classified as 'High' or 'Critical' priority can define, document, and implement more specific guidelines for the use of that particular data system. These guidelines can describe e.g. security requirements related to the data contained in the system.

The organisation should have a procedure for training and guidance of its personnel. These procedures should include and cover at least the following topics:

• Information security policies.
• Reporting of security incidents.
• Response to malware incidents.
• User account and login information policies (e.g., password policies).
• Compliance with information security regulations.
• Use of non-disclosure agreements (NDAs) when sharing sensitive information.
• Use of external IT services.

The training program should identify specific groups of employees who require this training, such as administrators, those with access to customer networks, and manufacturing personnel.

The training concept must be approved by responsible management. Conduct training and awareness programs regularly and in response to specific events. Ensure that employees know who to contact for information security concerns.