8.1.3 The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The …

Requirement

The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The awareness raising programme shall be updated and offered at planned intervals taking into account changes in cyber hygiene practices, and the current threat landscape and risks posed to the relevant entities.

Guidance

• Offer cybersecurity awareness raising programmes periodically.
• Test the effectiveness of the awareness raising programme for example by using quizzes or real scenarios.
• Consider common KPIs (Annex to the regulation, point 7.2) to measure the effectiveness of the awareness-raising programme.
• Review and update the awareness-raising programme at least annually.

Examples of evidence

• Logs, sign-in sheets, certificates of completion or acknowledgements given to employees upon completing the programme showing which employees have taken part in the awareness-raising programme.
• Results from any quizzes or assessments conducted to measure the employees’ understanding of the topics covered.
• Employee feedback forms on the awareness raising programme, which can provide insight into the effectiveness of the programme and areas for improvement.
• Reviewed and updated records showing that the programme is reviewed regularly and updated as necessary.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -