Documented operating procedures

Our organization has defined procedures for maintaining staff's cyber security awareness.These may include e.g. the following things:

• staff receive instructions describing the general guidelines of digital security related to their job role
• staff receive training to maintain the appropriate digital and cyber security skills and knowledge required for the job role
• staff demonstrate through tests that they have the security skills and knowledge required for the job role

Training should focus on the most relevant security aspects for each job role and include often enough the basics, which concern all employees:

• employee's personal security responsibilities (e.g. for devices and processed data)
• policies relevant for everyone (e.g. security incident reporting)
• guidelines relevant for everyone (e.g. clean desk)
• organization's security roles (who to contact with problems)

Personnel must have security guidelines that deal with e.g. the following topics:

• Using and updating mobile devices
• Storing and backing up data
• Privacy
• Using email
• Handling of printouts, papers and files
• Reporting incidents
• Scam prevention

Following security guidelines can be monitored either technically or directly by asking / testing employees.

If staff have conflicting goals with the security guidelines, they are unlikely to follow the guidelines.

The organization actively seeks to find poorly functioning guidelines and modify either the guidelines, tools or staff priorities to enable following the guidelines.