3.2.1
3.2.1
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
-
4.1.2.1 Top management shall demonstrate their commitment to the cyber security program by:
a) ensuring the cyber security policy and objectives are established and are aligned with the strategic direction of the organization;
b) ensuring that the resources needed for the cyber security program are available and are aligned with the cyber security policy and objectives;
c) communicating the importance of effective cyber security and of conforming to the cyber security program requirements;
d) establishing cybersecurity program metrics and tracking progress; and supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility.
e) supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility4.3.2.1 The organization shall train employees on basic security practices, including a focus on the following practical and easily implementable measures:
a. The use of effective password policies (see Subsection 5.5);
b. Identification of malicious emails and links;
c. Use of approved software;
d. Appropriate usage of the Internet; and
e. Safe use of social media;4.3.3.1 The organization shall invest in regular and ongoing cyber security awareness and training for their employees.