8.2 Security training

Requirement

The relevant entities shall identify employees, whose roles require security relevant skill sets and expertise and ensure that they receive regular training on network and information system security.

Guidance

• Assess which roles within the entity require security-relevant skills and expertise.
• Offer training that focuses on the specific security skills required by the identified roles.
• Consider globally recognized qualifications and certifications, and the ECSF (80).

Examples of evidence

• A comprehensive outline of the training programme, detailing the objectives for different roles and how to reach them, content and frequency of the training.

Requirement

The relevant entities shall establish, implement and apply a training program in line with the network and information security policy, topic-specific policies and other relevant procedures on network and information security which lays down the training needs for certain roles and positions based on criteria.

Guidance

• Provide role-specific network and information security training (81).
• Consider various training methods, such as online courses, workshops, hands-on labs and simulations.
• Consider various types of training, such as courses, certifications or attending security conferences or webinars, and the maintenance of certifications.
• Examples of training may include secure system administration courses for IT professionals, Open Worldwide Application Security Project ® awareness and prevention training for web application developers and advanced social engineering awareness training for high-profile roles.

Examples of evidence

• A comprehensive outline of the training programme, detailing the objectives for different roles and how to reach them, content and frequency of the training.
• Assessment of effect and feedback from trainings.

Requirement

The training referred to in point 8.2.1. shall be relevant to the job function of the employee and its effectiveness shall be assessed. Training shall take into consideration security measures in place and cover the following: (a) instructions regarding the secure configuration and operation of the network and information systems, including mobile devices; (b) briefing on known cyber threats; (c) training of the behaviour when security-relevant events occur.

Guidance

• Topics to include in the programme may include the following (indicative, non-exhaustive list).
  • Train personnel in authentication best practices, such as MFA, password creation and credential management.
  • Train personnel in how to identify and properly store, transfer, archive and destroy sensitive data.
  • Train personnel to recognise a potential incident, such as unusual email attachments, unexpected system behaviour and suspicious network traffic.
  • Train personnel in how to report events promptly and accurately, including the use of designated communication channels.
  • Train personnel to understand how to verify and report out-of-date software or any failures in automated processes and tools. Part of this training should include notifying IT personnel of any failures in automated processes and tools.
  • Train relevant personnel in crisis management and business continuity procedures. Incorporate simulated events (82) into crisis management training to facilitate an effective response by personnel in crisis situations.
  • Train relevant personnel (e.g. system administrators and software developers) in the secure configuration and operation of the network and information systems. Provide regular updates on the latest cyber threats.
• Test the security knowledge of employees to make sure that it is sufficient and up to date.

Examples of evidence

• Comprehensive outline of the training programme, detailing the objectives of different roles and how to reach them, and the content and frequency of the training.
• Results from any quizzes or assessments conducted to measure the employees’ understanding of the topics covered.

Requirement

The relevant entities shall apply training to staff members who transfer to new positions or roles which require security relevant skill sets and expertise.

Guidance

• Examine whether the new position or role of an employee requires role-specific network and information security training.

Examples of evidence

• Logs, sign-in sheets, certificates of completion or acknowledgements given to employees upon completing the training, showing that employees who transferred to new positions or roles attended training sessions relevant to the new position or role.
• Evidence of maintenance of certifications obtained.

Requirement

The program shall be updated and run periodically taking into account applicable policies and rules, assigned roles, responsibilities, as well as known cyber threats and technological developments.

Guidance

• Provide cybersecurity training periodically.
• Review and update the training programme at least annually.
• Encourage participation in threat-intelligence-sharing communities to stay informed about emerging threats.

Examples of evidence

• Logs, sign-in sheets, certificates of completion or acknowledgements given to employees upon completing the training, showing which employees attended the training sessions.
• Information materials distributed to employees, including handouts, presentations and online modules.
• Updates showing that the training programme is reviewed and updated regularly to keep up with the latest cybersecurity threats and best practices.
• Employee feedback forms on the training sessions, which can provide insight into the effectiveness of the training and areas for improvement.

TIP