+8.1 Awareness raising and basic cyber hygiene practices
---+8.1.1 For the purpose of Article 21(2), point (g) of Directive (EU) 2022/2555, the relevant entities …
---+8.1.2 For the purpose of point 8.1.1., the relevant entities shall offer to all employees, including …
---+8.1.3 The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The …

8.1 Awareness raising and basic cyber hygiene practices

Mapping to standards and frameworks

ISO standard 27001:20227.3, A.6.3, A.8.7
NIST Cybersecurity Framework v2.0PR.AT-01, PR.AT-02, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1REQ-7.2-01X, REQ-7.2-02, REQ-7.2-03X, REQ-7.2-04X, REQ-7.2-05X
CEN/TS 18026:2024HR-04, DOC-01
BE-CyFun®2023BASIC: PR.AT-1.1
IMPORTANT: PR.AT-1.2
ESSENTIAL: PR.AT-1.3
FI-KybermittariWORKFORCE-2, WORKFORCE-3, WORKFORCE-4, PROGRAM-2
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 4b.e, 21a, 21c
Cybersecurity Handbook: Part B: 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 10.12, 10.13, 10.14, 10.15, 12.1
Self-assessment tool: 11.1, 11.5, 11.6, 13.1
ENS-Royal Decree 311/2022Article 6
Annex II [mp.per.3] Awareness
FR4.1-IE/EE
4.2-IE/EE
4.3-EE
4.4-IE/EE
4.5-IE/EE
15.1-IE/EE

1. Prehľad

8.1.1 For the purpose of Article 21(2), point (g) of Directive (EU) 2022/2555, the relevant entities …

Requirement

For the purpose of Article 21(2), point (g) of Directive (EU) 2022/2555, the relevant entities shall ensure that their employees are aware of risks, are informed of the importance of cybersecurity and apply cyber hygiene practices.

Guidance

  • Implement cybersecurity awareness programmes:
    • use various formats, such as workshops, webinars and e-learning modules;
    • use multiple communication channels (emails, newsletters and intranet) to keep employees informed about cybersecurity updates, risks and cyber hygiene practices for users.

Examples of evidence

  • Awareness raising programme, for example a comprehensive outline of the programme, detailing its objectives, content, frequency, syllabus and schedule.
8.1.2 For the purpose of point 8.1.1., the relevant entities shall offer to all employees, including …

Requirement

For the purpose of point 8.1.1., the relevant entities shall offer to all employees, including members of management bodies, as well as to direct suppliers and service providers where appropriate in accordance with point 5.1.4, an awareness raising programme, which shall: (a) be scheduled over time, so that the activities are repeated and cover new employees; (b) be established in line with the network and information security policy, topic-specific policies and relevant procedures on network and information security; (c) cover cybersecurity risk-management measures in place, contact points and resources for additional information and advice on cybersecurity matters, as well as cyber hygiene practices for users.

Guidance

  • Include cyber hygiene practices (77) for relevant users (indicative, non-exhaustive list):
    • clear desk and screen policy,
    • use of relevant strong authentication means and methods, multi factor passwords etc,
    • event reporting,
    • safe email use and web browsing,
    • protection from phishing and social engineering,
    • secure use of mobile devices,
    • secure use of the entity’s connected-vehicles,
    • secure connection practices,
    • backup practices,
    • zero-trust concept,
    • software updates,
    • secure device configuration,
    • network segmentation,
    • secure teleworking practices.
  • Include the following in the programme (indicative, non-exhaustive list).
    • Train personnel on the policy on the security of network and information systems.
    • Train personnel to recognize social engineering attacks, such as phishing, pre-texting and tailgating.
    • Train personnel to be aware of causes of unintentional data exposure. Example topics include the erroneous delivery of sensitive data, losing a portable end-user device, providing unauthorized access to an entity’s connected-vehicle and the data stored on it and publishing data to unintended audiences.
    • Train personnel on the dangers of connecting to and transmitting data via insecure networks for the entity’s activities. If the entity has remote workers, training should include guidance to ensure that all users securely configure their home network infrastructure.
    • Train personnel in understanding malicious and unauthorised software, on the importance of malicious software detection and on the risks and consequences of using unauthorised software.
  • Offer employees contact points and resources for additional advice.
  • To implement the awareness raising programme, consult available sources, such as those from national or international cybersecurity organisations, ENISA’s AR-in-a-Box (78) and the Cybersecurity Skills Academy (79).

Examples of evidence

  • Awareness raising programme, that is, a comprehensive outline of the programme, detailing its objectives, content, frequency, syllabus and schedule.
  • Copies of the awareness-raising materials distributed to employees, including handouts, emails, presentations and online modules.
  • Logs, sign-in sheet, certificates of completion or acknowledgements given to employees upon completing the programme, showing which employees have taken part in the awareness-raising programme.
8.1.3 The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The …

Requirement

The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The awareness raising programme shall be updated and offered at planned intervals taking into account changes in cyber hygiene practices, and the current threat landscape and risks posed to the relevant entities.

Guidance

  • Offer cybersecurity awareness raising programmes periodically.
  • Test the effectiveness of the awareness raising programme for example by using quizzes or real scenarios.
  • Consider common KPIs (Annex to the regulation, point 7.2) to measure the effectiveness of the awareness-raising programme.
  • Review and update the awareness-raising programme at least annually.

Examples of evidence

  • Logs, sign-in sheets, certificates of completion or acknowledgements given to employees upon completing the programme showing which employees have taken part in the awareness-raising programme.
  • Results from any quizzes or assessments conducted to measure the employees’ understanding of the topics covered.
  • Employee feedback forms on the awareness raising programme, which can provide insight into the effectiveness of the programme and areas for improvement.
  • Reviewed and updated records showing that the programme is reviewed regularly and updated as necessary.

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

Požiadavky

3. Súvisiace predpisy

Predpisy

Prepojené úlohy

Prepojenia
is related to 8.1. Awareness raising and basic cyber hygiene practices