Regularly give all officers and employees, management included, awareness training suited to roles and responsibilities; ensure third-party staff receive the cybersecurity training their work needs (including their roles in the institution's incident response and recovery plans where needed), which may be satisfied by confirming the third party's own training, on a risk basis; carry out customer awareness where needed (for example phishing warnings on the website); regularly train IT and security staff to keep knowledge and skills current; and give all staff the chance to learn how to act if they are part of an incident, with regular training on roles and procedures in the incident response and recovery plans for those involved.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.