Habit 06 of 18
People
Security training for staff
Everyone learns to spot phishing and handle data safely, at least once a year.
Most attacks on small firms start with an email. People who can spot one are your best defence.
Switch it on in the map Counts towards 4 articles, controls and categories
§1 How to do it
How a small firm does it
- Give everyone short security training when they join and at least once a year.
- Cover phishing, passwords and two-step sign-in, and how to handle personal data.
- Tell people exactly how to report something suspicious, and thank them when they do.
- Keep a record of who did the training and when.
Evidence that shows it
- Training records with names and dates
- The material or provider used
Ireland: NCSC Ireland guidance on awareness and training applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 2 items
-
Art 20 Management approves and oversees security measures · supports
shall encourage essential and important entities to offer similar training to their employees on a regular basis
Article 20(2) requires training for management and encourages regular, similar training for all staff.
Read Art 20(2) on EUR-Lex -
21(2)(g) Basic cyber hygiene and training · subset
basic cyber hygiene practices and cybersecurity training
Cyber security training is named in this measure, alongside basic cyber hygiene.
Read Art 21(2)(g) on EUR-Lex
ISO/IEC 27001:2022 1 item
-
A.6.3 Security awareness and training · equal
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control and the practice describe the same thing: regular security awareness and training for staff.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 1 item
-
PR.AT Awareness and training · subset
PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
Yearly training for all staff is this outcome for general staff. Training for specialised roles is the rest of the category.
Read PR.AT-01 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.