What is the All-Hands Security Training control?
Strike Graph's default control language is: "Employees and contractors complete security-related training, as relevant to their duties, upon hire and on an annual basis. The annual security training includes information on how to report security incidents and concerns."
This language should be customized to reflect the specific process that your organization has defined. For example, if your organization's security training contains different content or occurs at a different frequency, then you should update the control language to reflect that. It's important that your stated control description accurately reflects how your organization implements this control.
Why is this control important?
Most IT Security frameworks require employees to undergo security training. Regardless of which framework you are pursuing, training makes great business sense. Human error is the leading cause of security breaches, but you can mitigate this risk by providing the awareness and tools to keep your staff informed and out of the news.
Who's involved with this control?
Typical Control Owner: CTO (or equivalent) - for training oversight
Typical Parties Involved:
HR director - runs the training program
HR Admin - ensures that new hires take the training
Security Manager - delivers to all hands, all staff, and (as appropriate) contractors - participants
How do I perform this control?
All employees should participate in an annual data and IT security training. Each new hire should also take the training as part of their onboarding. You can choose to use a third party training provider OR you can create your own training program.
Training should include: phishing examples, do’s and don’ts, common attacks and what to watch out for. Successful training will be interactive, include real world examples, and could even include a few YouTube videos.
When preparing the training materials, ensure that all other relevant content is completed prior to the training. For example, if you are including incident response procedures, ensure that the IR plan is complete.
Include guidance on what employees should do if they think there has been a security incident, as well as what they should do in the event of a natural disaster.
Hot tip: If you are on a SOC 2 path, the best time to hold the all hands training will be about 45 days prior to the end of the audit period.
Want to learn more?
Reach out to your Customer Success Manager via email or the chat widget.