Information Security Awareness, Education and Training
Description
Personnel of the organisation and relevant interested parties shall receive appropriate information security awareness, education, and training; regular updates of organisational policies and procedures shall be provided as relevant to their job function.
⚠️ Risk Impact
Untrained staff are the dominant attack vector in 2024. Phishing, BEC, and social engineering all target humans. Investment in training has higher ROI than investment in tools for credential-related attacks.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.
🔧 Remediation
Annual security awareness training for all staff. Role-based deep-dives. Quarterly phishing simulations. Track completion via HRIS. Brief executives separately (whaling target).
💀 Real-World Attack Scenario
An untrained finance team received a deepfake-voice CEO request authorising a $2.5M wire to a 'new supplier'. The team hadn't received training on deepfake voice fraud (emerging vector). The wire was sent. Recovery: $300K (insurance covered $1M). Avg deepfake-fraud loss in 2024: $25M (Hong Kong case).
💰 Cost of Non-Compliance
Untrained-staff breaches: 3.2× higher cost (PwC 2024). FBI IC3 BEC losses 2023: $2.9B.
📋 Audit Questions
- 1.What is the annual training curriculum?
- 2.Role-based deep-dives — engineering vs finance vs executive?
- 3.Last phishing-simulation click-rate?
- 4.How is completion tracked?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Generic awareness training without role-specific depth
- ⛔Phishing simulations done once for compliance then forgotten
- ⛔Training completion tied to nothing — staff click through to mark complete
📈 Business Value
Effective training reduces phishing-vector breaches by 70%+. Lowest-cost / highest-impact security investment after MFA.
⏱️ Effort Estimate
20-40 hours annual program + 8 hours quarterly phishing
EchelonGraph integrates with KnowBe4 / Proofpoint for completion tracking
🔗 Cross-Framework References
Automate ISO 27001 A.6.3 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →