Does your organization provide cybersecurity awareness and training to all users with access to non-public resources?

Cybersecurity awareness training helps users recognize and respond appropriately to security threats like phishing, social engineering, and data handling requirements. This training should be provided to all individuals with access to sensitive information, including employees, contractors, partners, and suppliers, as they all represent potential security vulnerabilities if not properly educated. Evidence could include training materials, attendance records, completion certificates, training schedules, or screenshots of your learning management system showing cybersecurity courses assigned to different user types. An annual training calendar or policy document outlining training requirements for different user categories would also serve as supporting evidence.