All users are informed and trained from Cybersecurity Fundamentals framework

SAMMY UI is optimized for resolutions with a width 1024px and higher.

Maturity Level 1

Maturity Level 2

Maturity Level 3

PR.AT-1.1

PR.AT-1.1: Employees shall be trained as appropriate.

Employees include all users and managers of the ICT/OT systems, and they should be trained immediately when hired and regularly thereafter about the company’s information security policies and what they will be expected to do to protect company’s business information and technology.
Training should be continually updated and reinforced by awareness campaigns.

Employees shall be trained as appropriate.

PR.AT-1.2

PR.AT-1.2: The organization shall incorporate insider threat recognition and reporting into security awareness training.

Consider to:
Communicate and discuss regularly to ensure that everyone is aware of their responsibilities.
Develop an outreach program by gathering in a document the messages you want to convey to your staff (topics, audiences, objectives, etc.) and your communication rhythm on a calendar (weekly, monthly, one-time, etc.). Communicate continuously and in an engaging way, involving management, IT colleagues, the ICT service provider and HR and Communication managers.
Cover topics such as: recognition of fraud attempts, phishing, management of sensitive information, incidents, etc. The goal is for all employees to understand ways to protect company information.
Discuss with your management, your ICT colleagues, or your ICT service provider some practice scenarios (e.g. what to do if a virus alert is triggered, if a storm cuts off the power, if data is blocked, if an account is hacked, etc.), determine what behaviours to adopt, document and communicate them to all your staff. The central point of contact in the event of an incident should be known to all.
Organize a simulation of a scenario to test your knowledge. Consider performing the exercise for example at least once a year.

The organization shall incorporate insider threat recognition and reporting into security awareness training.

PR.AT-1.3

PR.AT-1.3: The organization shall implement an evaluation method to measure the effectiveness of the awareness trainings.

The organization shall implement an evaluation method to measure the effectiveness of the awareness trainings.