8.1.2. For the purpose of point 8.1.1, the relevant entities shall offer to their employees …

(a)

be scheduled over time, so that the activities are repeated and cover new employees;

(b)

be established in line with the network and information security policy, topic-specific policies and relevant procedures on network and information security;

(c)

cover relevant cyber threats, the cybersecurity risk-management measures in place, contact points and resources for additional information and advice on cybersecurity matters, as well as cyber hygiene practices for users.