A comprehensive training programme, proportionate to the institution, raises awareness of IT risk and equips staff to mitigate the risks of their daily work, covering at least the institution's policies and standards, the specific IT and especially cybersecurity risks staff face, their responsibility for mitigating risk and reporting risk events, practical day-to-day steps, and applicable law, regulation and guidance. Content is tailored to each audience, whether board members, senior managers, IT staff or general staff, with targeted training for high-risk groups such as privileged users and sensitive functions; all permanent and temporary staff are trained regularly and new joiners as soon as practical; and the programme is reviewed periodically against emerging risks.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.