DS07 User Education and Training

Management of comprehensive user training and development plan.

Needs: establish and maintain procedures for identifying and documenting the training needs of all personnel making use of information services,
Organization: Identify and appoint trainers and organize timely training sessions. Training alternatives should also be investigated (internal or external location, in-house trainers or third-party trainers, etc.),
Security Principles and Awareness Training: Provide an education and training program.

Measured improvement in employee optimisation of IT resources to maximise business value
Measured improvement in employee awareness of ethical conduct requirements, system security principles and performance of duties in an ethical and secure manner
Measured improvement in security practices to protect against harm from failures affecting availability, confidentiality and integrity
Number of help desk calls for training or to answer questions
Increased user satisfaction with roll out of new technologies

Percentage of employees trained
Age of employee training curricula
Time lag between identification of training need and the delivery of the training
Number of training alternatives available to employees from in-house and third-party sources
Percentage of employees trained in ethical conduct requirements
Number of identified employee ethical violations
Percentage of employees trained in security practices
Number of identified security incidents related to employees
Increased identification and documentation of training needs and delivery of timely training

A comprehensive education and training program, focused on individual and corporate needs, is in place
The education and training programs are supported by budgets, resources, facilities and trainers
Training and education are critical components of the employee career paths
Employees and managers identify and document training needs
Needed training is provided in a timely manner
There is senior management support to ensure that employees perform their duties in an ethical and secure manner
Employees receive system security practices training in protecting against harm from failures affecting availability, confidentiality and integrity
Corporate policy requires that all employees receive a basic training program covering ethical conducts, system security practices and permitted use of IT resources
There is management acceptance that training costs are investments in lowering the total costs of technology ownership