8.2.3 The training referred to in point 8.2.1. shall be relevant to the job function of the employee and …

Requirement

The training referred to in point 8.2.1. shall be relevant to the job function of the employee and its effectiveness shall be assessed. Training shall take into consideration security measures in place and cover the following: (a) instructions regarding the secure configuration and operation of the network and information systems, including mobile devices; (b) briefing on known cyber threats; (c) training of the behaviour when security-relevant events occur.

Guidance

• Topics to include in the programme may include the following (indicative, non-exhaustive list).
  • Train personnel in authentication best practices, such as MFA, password creation and credential management.
  • Train personnel in how to identify and properly store, transfer, archive and destroy sensitive data.
  • Train personnel to recognise a potential incident, such as unusual email attachments, unexpected system behaviour and suspicious network traffic.
  • Train personnel in how to report events promptly and accurately, including the use of designated communication channels.
  • Train personnel to understand how to verify and report out-of-date software or any failures in automated processes and tools. Part of this training should include notifying IT personnel of any failures in automated processes and tools.
  • Train relevant personnel in crisis management and business continuity procedures. Incorporate simulated events (82) into crisis management training to facilitate an effective response by personnel in crisis situations.
  • Train relevant personnel (e.g. system administrators and software developers) in the secure configuration and operation of the network and information systems. Provide regular updates on the latest cyber threats.
• Test the security knowledge of employees to make sure that it is sufficient and up to date.

Examples of evidence

• Comprehensive outline of the training programme, detailing the objectives of different roles and how to reach them, and the content and frequency of the training.
• Results from any quizzes or assessments conducted to measure the employees’ understanding of the topics covered.

1. Áttekintés

1.1 Hivatkozások

1.2 Azonosított követelmények

1.3 Kapcsolódó szabályozások

2. Azonosított követelmények

3. Kapcsolódó szabályozások

Kapcsolt feladatok

• ENISA -