8.1.2 For the purpose of point 8.1.1., the relevant entities shall offer to all employees, including …

Requirement

For the purpose of point 8.1.1., the relevant entities shall offer to all employees, including members of management bodies, as well as to direct suppliers and service providers where appropriate in accordance with point 5.1.4, an awareness raising programme, which shall: (a) be scheduled over time, so that the activities are repeated and cover new employees; (b) be established in line with the network and information security policy, topic-specific policies and relevant procedures on network and information security; (c) cover cybersecurity risk-management measures in place, contact points and resources for additional information and advice on cybersecurity matters, as well as cyber hygiene practices for users.

Guidance

• Include cyber hygiene practices (77) for relevant users (indicative, non-exhaustive list):
  • clear desk and screen policy,
  • use of relevant strong authentication means and methods, multi factor passwords etc,
  • event reporting,
  • safe email use and web browsing,
  • protection from phishing and social engineering,
  • secure use of mobile devices,
  • secure use of the entity’s connected-vehicles,
  • secure connection practices,
  • backup practices,
  • zero-trust concept,
  • software updates,
  • secure device configuration,
  • network segmentation,
  • secure teleworking practices.
• Include the following in the programme (indicative, non-exhaustive list).
  • Train personnel on the policy on the security of network and information systems.
  • Train personnel to recognize social engineering attacks, such as phishing, pre-texting and tailgating.
  • Train personnel to be aware of causes of unintentional data exposure. Example topics include the erroneous delivery of sensitive data, losing a portable end-user device, providing unauthorized access to an entity’s connected-vehicle and the data stored on it and publishing data to unintended audiences.
  • Train personnel on the dangers of connecting to and transmitting data via insecure networks for the entity’s activities. If the entity has remote workers, training should include guidance to ensure that all users securely configure their home network infrastructure.
  • Train personnel in understanding malicious and unauthorised software, on the importance of malicious software detection and on the risks and consequences of using unauthorised software.
• Offer employees contact points and resources for additional advice.
• To implement the awareness raising programme, consult available sources, such as those from national or international cybersecurity organisations, ENISA’s AR-in-a-Box (78) and the Cybersecurity Skills Academy (79).

Examples of evidence

• Awareness raising programme, that is, a comprehensive outline of the programme, detailing its objectives, content, frequency, syllabus and schedule.
• Copies of the awareness-raising materials distributed to employees, including handouts, emails, presentations and online modules.
• Logs, sign-in sheet, certificates of completion or acknowledgements given to employees upon completing the programme, showing which employees have taken part in the awareness-raising programme.

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

3. Relaterade regleringar

Länkade ärenden

• ENISA -