Has the team had any cyber awareness training in the last year?
Demonstrate that all employees and relevant contractors have completed documented cybersecurity awareness training within the trailing twelve-month period.
Description
What this control does
This control validates that all team members have completed cybersecurity awareness training within the past twelve months. Organizations deliver this training through formal programs covering topics such as phishing recognition, password hygiene, social engineering tactics, data handling, incident reporting, and acceptable use policies. Regular annual refresher training ensures personnel remain current on evolving threats and organizational security expectations, reducing human-factor risk across the enterprise.
Control objective
What auditing this proves
Demonstrate that all employees and relevant contractors have completed documented cybersecurity awareness training within the trailing twelve-month period.
Associated risks
Risks this control addresses
- Employees falling victim to phishing attacks due to inability to recognize malicious emails or links
- Unintentional data exfiltration or exposure through poor handling of sensitive information
- Credential compromise from weak password practices or password reuse across accounts
- Failure to report security incidents promptly, allowing threats to propagate undetected
- Social engineering exploitation due to lack of awareness about manipulation tactics
- Insider threat enablement through ignorance of acceptable use policies and monitoring practices
- Non-compliance with regulatory requirements mandating periodic security awareness training
Testing procedure
How an auditor verifies this control
- Request the organization's cybersecurity awareness training policy and supporting documentation defining frequency, scope, and required participants.
- Obtain a complete roster of all current employees, contractors, and third-party personnel with system access as of the audit date.
- Request training completion records from the learning management system (LMS) or training platform covering the trailing twelve-month period.
- Generate a comparison report matching personnel roster against training completion records to identify any individuals without documented training.
- Select a stratified random sample of 15-25 individuals across departments and roles to validate training completion details.
- For sampled individuals, verify training completion dates, module topics covered, assessment scores (if applicable), and certificate issuance.
- Interview human resources and security team members to confirm processes for onboarding training and tracking overdue completions.
- Review evidence of follow-up actions taken for personnel who missed training deadlines or failed assessments.