Cyber Hygiene Practice and Cybersecurity Training

52. The head of the cybersecurity entity or a person authorised by them must establish the procedure for organising cyber hygiene practice and for organising and delivering cybersecurity training. The cybersecurity manager must ensure that all employees of the cybersecurity entity attend cyber hygiene practice training at least once a year.

53. The cybersecurity entity must ensure that employees are kept informed about current cybersecurity matters (the methods of training and informing are chosen having regard to the specific nature of the network and information system).

54. Within three months of training organised on cybersecurity matters, a training report must be prepared stating the training topic and the number of participants. The cybersecurity entity has the right to purchase training on the specified topics from third parties or to organise it itself. The cybersecurity entity must retain the training report for at least three years from the date on which the report was approved.