6.3

Information Security Awareness, Education, and Training

The organization’s personnel and relevant parties should undergo suitable information security awareness, education, and training. They should also receive regular updates on the organization’s policies and procedures relevant to their roles.

CAN/CIOSC 104 Overlap

4.3.2.1 The organization shall train employees on basic security practices, including but not limited to the following practices:

a. Compliance with password policies

b. Identification of malicious communications and phishing;

c. Keeping employee devices and software updated.

d. Principle of least privilege and basic access controls.
NIST 800-171 R2 Overlap
NIST 800-171 R3 Overlap

6.3

Information Security Awareness, Education, and Training

Get certified