Everyone with access to IT or OT systems, including contractors, must be trained on recognising threats and incidents, circumvention techniques, reporting to the CySO and OT-specific topics by 12 January 2026 and annually (new staff within 5 days of access and no later than 30 days after hiring), key personnel also on incident roles and current threats, and all personnel on the relevant plan provisions within 60 days of plan approval; untrained people must be accompanied or monitored.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.