8.2.2 The relevant entities shall establish, implement and apply a training program in line with the …

Requirement

The relevant entities shall establish, implement and apply a training program in line with the network and information security policy, topic-specific policies and other relevant procedures on network and information security which lays down the training needs for certain roles and positions based on criteria.

Guidance

• Provide role-specific network and information security training (81).
• Consider various training methods, such as online courses, workshops, hands-on labs and simulations.
• Consider various types of training, such as courses, certifications or attending security conferences or webinars, and the maintenance of certifications.
• Examples of training may include secure system administration courses for IT professionals, Open Worldwide Application Security Project ® awareness and prevention training for web application developers and advanced social engineering awareness training for high-profile roles.

Examples of evidence

• A comprehensive outline of the training programme, detailing the objectives for different roles and how to reach them, content and frequency of the training.
• Assessment of effect and feedback from trainings.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• ENISA -