Do employees receive security awareness training?
A people and suppliers question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Yes. Every member of staff completes security training at onboarding and [every year], covering phishing, data handling and incident reporting, through [provider or internal course].
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- Training completion records
- The course outline
If you don't do this yet
A short internal session counts if it's recorded. Say what's covered and how often, and don't claim a completion rate you haven't measured.
Related questions
Do you perform background checks on employees?A model answer, the evidence behind it, and what to say if you don't do it yet.How do you assess the security of your vendors?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.