Our organization has defined procedures for maintaining staff's cyber security awareness.These may include e.g. the following things:
Training should focus on the most relevant security aspects for each job role and include often enough the basics, which concern all employees:
Personnel must have security guidelines that deal with e.g. the following topics:
Following security guidelines can be monitored either technically or directly by asking / testing employees.
A log is kept of the cyber security training events provided by the organization to its staff. The log can be used to show what kind of specific investments the organization has made towards staff's cyber security expertise.
For each training the documentation should include:
If staff have conflicting goals with the security guidelines, they are unlikely to follow the guidelines.
The organization actively seeks to find poorly functioning guidelines and modify either the guidelines, tools or staff priorities to enable following the guidelines.