Guidelines for personnel security

All staff receive yearly training on using and protecting systems, and reporting incidents.

Develop and maintain a policy to manage how the web is used and accessed.

Staff learn to recognise and report suspicious online contact.

Staff should not share work info on unauthorised sites and must report if such info is found online.

Employees should be aware of the dangers of posting their personal info on the internet.

Staff should not use online services for files unless approved to avoid security risks.

Keep your personal and work user accounts separate when using online services.

Everyone holding privileged access to systems or their resources completes training built for that role every year, so elevated rights are used safely and knowingly.

Employees should know about email fraud in banking and how to manage and report it.

Maintain a record of all cyber security awareness training activities within an organisation.

Staff handling user accounts learn to identify and handle social engineering threats.

Organisations must create and update policies for using AI systems.

Staff are told not to post their security clearance or briefing details on unapproved online services and to report it when such information appears.

Staff are told to limit posting information about their work duties on unauthorised online services and to report any cases where such information is posted.

Advise staff to limit posting their work-related skills and experience on unauthorised online services, and to report cases where such information is posted.

Encourage personnel to apply the privacy settings available on online services so they control who can view the personal information they post.

Staff confirm who is really asking, using an agreed authentication method or a separate trusted channel, before changing account or banking details or making payments.