1. Document Control

• Document Title: Security Awareness and Training Policy

• Document Identifier: POL-HR-002

• Version Number: v1.0

• Approval Date: <23 June 2025>

• Effective Date: <23 June 2025>

• Review Date: <23 June 2026>

• Document Owner: <Director of Human Resources>

• Approved By: <Chief Information Security Officer>

2. Purpose

The purpose of this Security Awareness and Training Policy is to ensure that all personnel are equipped with the knowledge and skills necessary to recognize, prevent, and respond to information security threats. A well-informed workforce is a fundamental line of defense against phishing, data breaches, insider threats, and other risks that target human behavior.

This policy is designed to comply with SOC 2 Trust Services Criteria CC2.1 and CC2.2, which require organizations to establish and maintain procedures for training personnel to carry out their responsibilities securely. It also supports ISO/IEC 27001:2022 Controls A.6.3 (Awareness, education and training), A.6.4 (Disciplinary process), and A.6.5 (Responsibilities after termination or change).

3. Scope

This policy applies to:

• All employees, contractors, interns, and temporary workers of

• All users with access to ’s information systems, applications, or data

• All locations and departments across the organization, including remote and field staff

The policy governs initial onboarding, ongoing training, role-specific modules, and awareness campaigns across the enterprise.

4. Policy Statement

shall:

1. Deliver mandatory information security training to all new hires during onboarding and annually thereafter.

2. Provide targeted training based on user roles, access levels, and associated risks (e.g., developers, finance, executives).

3. Update training materials regularly to reflect emerging threats, compliance requirements, and policy changes.

4. Conduct awareness campaigns on high-risk topics such as phishing, password hygiene, data protection, and remote work safety.

5. Use simulated social engineering tests (e.g., phishing campaigns) to measure effectiveness and identify high-risk individuals or groups.

6. Require documented attestation or tracking of course completion, scores, and ongoing participation.

7. Include failure to complete training as a compliance violation subject to corrective action.

5. Safeguards

maintains the following safeguards to enforce security awareness and training: