THP-1 - Cybersecurity Training
Control for ongoing information security training for all staff
Control Definition
A continuous cybersecurity training program must be implemented for all employees, recognizing the human factor as the main attack vector, and specialized training must be provided to roles with greater security responsibility or exposure. Phishing simulations must be run on a scheduled basis, corrective training applied to those who interact with them, and the program's effectiveness measured, reporting its results to the security committee. All staff must know and understand the information security policy and their responsibilities, including those that persist after employment ends, and there must be a formal disciplinary process for non-compliance.
Requirements
Requirement 1
We implement a continuous cybersecurity training program for all employees in the organization.
Requirement 2
New employees complete cybersecurity induction courses within a defined time.
Requirement 3
We provide annual cybersecurity refresher training for the entire workforce.
Requirement 4
We provide specialized training to roles with security responsibilities or that are security-critical.
Requirement 5
We apply immediate corrective training to employees who click or provide credentials in simulated phishing.
Requirement 6
We hold periodic talks on emerging threats.
Requirement 7
We identify the knowledge and skills required of people whose work impacts information security and take action to close the competence gaps identified.
Requirement 8
We make sure everyone in the organization knows and understands the information security policy, how their work contributes to the management system and what can happen if they don't meet the established requirements.
Requirement 9
We make sure staff receive periodic updates on the information security policy and the procedures related to their role.
Requirement 10
We include staff and organizational information security responsibilities in employment contracts.
Requirement 11
We have a formal disciplinary process that defines the actions to take when someone causes a security breach, and we communicate it to employees and relevant interested parties.
Requirement 12
We define, enforce and communicate to staff and interested parties the information security responsibilities that remain in force when someone leaves or changes role in the organization.
Requirement 13
We deliver a cybersecurity course with a defined curriculum to the whole company, covering common cybercrime methods, data protection and artificial intelligence.
Requirement 14
We run internal phishing simulations on a scheduled basis to assess security awareness.
Requirement 15
We analyze simulation results to identify high-risk groups and adapt the awareness program.
Requirement 16
We define minimum pass rates as a set percentage and track completion by area.
Requirement 17
We report the training program's effectiveness metrics to the security committee.
Requirement 18
We keep documented evidence showing that staff have the necessary information security competencies.