NIST CSF 2.0, ProtectPR.AT-01

Establish a policy and procedures to assess whether your cybersecurity risk-management measures are effectively implemented and maintained (point 7.1), offer your employees an awareness raising programme and give those whose roles require security skills regular training (points 8.1.2 and 8.2.1), and apply the Annex's requirements on cryptography, human resources security, access control, asset management, and environmental and physical security (points 9 to 13).

Have capabilities and staff to gather information on vulnerabilities, cyber threats and ICT-related incidents, run post-incident reviews after a major ICT-related incident disrupts your core activities, build the lessons from testing and real incidents into the ICT risk assessment, have senior ICT staff report at least yearly to the management body, and make ICT security awareness programs and digital operational resilience training compulsory modules for all employees and senior management (Article 13).

Give every employee and official who uses your ICT resources an initial cybersecurity briefing within one month of registering their user account and a routine briefing at least once a calendar year, and train your ICT staff at least once a year (point 76).

Draft a cyber-risk-management and ICT-business-continuity plan and give your staff regular training on carrying it out; the Cabinet sets the plan's required content (Article 28(2)), and Cabinet Regulation No. 397 of 25 June 2025, 'Minimālās kiberdrošības prasības', sets the minimum cybersecurity requirements your systems must meet.

Make your staff aware of the risks to your network and information systems, have them apply cyber-hygiene practices, and give those whose roles need security expertise regular training (Article 12); keep a written cryptography policy that sets out when cryptography is used and who is responsible for key management (Article 13).

The Department says your training should ensure all personnel are aware of the risks posed by AI, the procedures you have adopted to mitigate them, and how to respond to AI-enhanced social engineering attacks, and that training for cybersecurity personnel should include how threat actors use AI in social engineering attacks, how AI facilitates and enhances existing types of cyberattacks, and how AI can improve cybersecurity.

Provide cybersecurity awareness training that includes social engineering to all personnel periodically and at least annually, updated to reflect the risks you identified in your risk assessment.

Take security measures appropriate to the risk of unauthorized access, alteration, or loss of personal data, taking the state of technology and the cost of the measures into account, and make sure staff know and follow them.

Establish and maintain a full-process data-security management system covering the collection, storage, use, processing, transmission, provision, and disclosure of the data you process, and provide data-security education and training to your staff.