Awareness Management Policy
Information security training and awareness program
Purpose
This policy defines how the organization develops and maintains its Information Security and Business Continuity Awareness Program. The central goal is to ensure that all employees understand the risks, know how to act in the event of incidents and comply with current policies and regulatory requirements.
Scope
This policy applies to all members of the organization: employees, contractors, temporary staff and vendors with access to the company's systems or information.
Objectives
- Strengthen understanding of each employee's role in protecting assets and operational continuity.
- Train staff to identify, report and respond appropriately to incidents or disruptions.
- Ensure everyone knows and complies with security policies, continuity plans and regulatory obligations.
Responsibilities
- Information Security Team and Business Continuity Team: design, run and maintain the Awareness Program.
- Area leads: ensure their teams take part.
- All employees: complete the mandatory training and apply what they've learned.
Program Standards
Mandatory Annual Training
Formal training will be held every year, covering:
- Current risks and threats.
- Incident management.
- Data Protection.
- Compliance with policies and regulations.
- Key elements of the business continuity plans.
Periodic Awareness Campaigns
Regular campaigns will be run to reinforce good practices and warn about emerging risks.
New Employee Induction
Every new team member must receive initial training in security, data protection and continuity as part of the onboarding process.
Refresher Training
Short refresher sessions will be held when there are relevant changes in risks, processes, technology or regulations.
Training Records
Up-to-date records of participation in and completion of all Awareness Program activities will be kept.
Communications Plan
A periodic communications plan will be carried out with short messages about current risks and good practices, distributed through the organization's internal channels.
Phishing Campaigns
Periodic phishing simulations will be run to measure staff exposure, with immediate feedback and refresher training for those who interact with the simulation.
Re-onboarding
Employees who change roles, return after a prolonged absence, or perform poorly in assessments or campaigns will be included in a re-onboarding process that reinforces the expected security practices.
Compliance Validation
Each employee and each area lead will validate, through periodic checklists, the completion of the training, campaigns and individual and team responsibilities defined by the Awareness Program.
Related Documents
Monitoring and Review
- Employees' level of understanding will be periodically assessed through tests, surveys or practical exercises.
- The program's performance will be reported to management, including compliance metrics and areas for improvement.
- The policy and program will be reviewed upon organizational, technological or regulatory changes to ensure they remain current and effective.