AW001Workforce awareness on insider risk

The instruction of the workforce in what the program is, what it asks of them, and what it protects.

Pillar: AW | Awareness and training
Sources cited: 19
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
AW001/EUMandatory	European Union	Directive (EU) 2022/2555, article 21European Parliament and Council · read 29 Aug 2026Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026	That asset management, access control policies, human resources security, cryptography, and training are among the measures an entity in scope has to take, without saying what any of them holds.	Basic cyber hygiene practices and cybersecurity training are named among the measures an entity in scope has to take, and the implementing rules say what the awareness program holds: it is scheduled over time so that it repeats and reaches new employees, it covers the threats, the measures in place, and where to go for advice, it reaches direct suppliers and service providers as well as employees and the members of the management bodies, and it is tested for effectiveness where appropriate. What is asked to be taught is the security of systems, not insider risk.
AW001/HRMandatory	Croatia	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, the persons responsible for the measures follow suitable training and enable the employees to follow suitable training, and basic cyber hygiene and cybersecurity training are among the measures.
AW001/GRMandatory	Greece	Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026Νόμος 4990/2022, άρθρα 8, 9, and 10https://www.taxheaven.gr/law/4990/2022/arthro/9 · read 5 Oct 2026	For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the members of the management bodies follow training and the entity gives its employees similar training at least annually, to identify risks and assess risk management practices; basic cyber hygiene and cybersecurity training are among the measures. The Υ.Π.Π.Α. designs and coordinates training on ethics and integrity and takes part in internal policies on integrity and transparency.
AW001/HUMandatory	Hungary	7/2024. (VI. 24.) MK rendelet a biztonsági osztályba sorolás követelményeiről, valamint az egyes biztonsági osztályok esetében alkalmazandó konkrét védelmi intézkedésekről, 2. mellékletMiniszterelnöki Kabinetiroda (the minister responsible for informatics) · read 5 Oct 2026	That an insider threat program with a multidisciplinary team handling insider security events is in the catalogue and is marked for none of the three classes; that awareness training on recognizing and reporting potential signs of insider threats is required in all three classes; that a risk designation of every position with screening criteria, screening of persons before access and re-screening on change of authorization or position or periodically, and a termination process that disables access within a defined time, revokes all credentials and authorizations, holds an exit interview on information security, and retrieves security assets are required in all three classes; and that the periodic review of privileges and the logging of privileged functions are required in the “jelentős” and “magas” classes.	For systems in all three security classes, the organization gives training on recognizing and reporting the potential signs of insider threats.
AW001/ITMandatory	Italy	Determinazione ACN n. 379907 del 18 dicembre 2025Agenzia per la cybersicurezza nazionale · read 29 Aug 2026	The baseline security measures an Italian NIS subject has to adopt, among them the recording of remote and administrative access and its central retention, the detection of privilege abuse, and the vetting of the people admitted to the systems that matter.	For a subject in the national NIS register, a training plan for the workforce, the administrative and management bodies included, is defined, implemented, kept current, and documented, and those bodies approve it. It sets out what is taught and, where any are provided for, how it is checked that the content was taken in. What it teaches is the security of systems, not insider risk.
AW001/PTMandatory	Portugal	Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026	For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report.	For entities in scope, all staff are made aware and trained in cybersecurity under a plan whose success is measured, and at the higher conformity level the training includes awareness and communication of internal threats so that staff recognize and respond to them.
AW001/ROMandatory	Romania	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the entity ensures professional training of all personnel to a sufficient level of knowledge and skills, and basic cyber hygiene and training are among the measures.
AW001/ESMandatory	Spain	Real Decreto 311/2022, Esquema Nacional de SeguridadGobierno de España · read 29 Aug 2026	The security measures a Spanish public sector body has to apply, graded by category, among them the concurrence of two people on critical tasks so that no single authorized individual can abuse their rights, an access control on the activity records themselves, and the recording of evidence where an incident may end in disciplinary action.	The workforce is reminded periodically of the security rules on the proper use of the equipment and of the commonest social engineering techniques, of how to identify an incident and the activities or behaviors that are suspicious and have to be reported so that specialized staff can deal with them, and of the procedure for reporting, whether what is reported turns out to be real or a false alarm.
AW001/SEMandatory	Sweden	Cybersäkerhetslag (2025:1506)Riksdag · read 5 Oct 2026	That operators in scope take appropriate and proportionate technical, operational, and organizational measures that include access control and asset management, personnel security, cryptography, and cyber hygiene and training, that the persons in an operator’s management undergo training on security measures, that a significant incident is notified within 24 hours of knowledge and reported within 72 hours with a final report within one month, and that the government designates the supervisory authority or authorities.	For operators in scope, the measures include basic cyber hygiene practices and cybersecurity training, and the persons in the management undergo training on security measures.
Recommended	European Unionwhere written	Help2ProtectCoESS and partners, co-funded by the Internal Security Fund of the European Union · read 11 Aug 2026	Awareness and program-building material for critical infrastructure operators, with templates, and no legal basis stated for any of it.	A Union-funded platform carries an awareness module and downloadable templates, addressed mainly to transport, energy, and other critical infrastructure operators.
Recommended	European Unionwhere written	Insider Threat Program Development ManualCoESS, co-financed by the Internal Security Fund of the European Union · read 11 Aug 2026	The structure of an insider risk management program, as the closest thing to doctrine issued under European Union funding, unrevised since 2019.	The Union-funded manual addresses the structure of a program rather than the conditions attached to one, and has not been revised since 2019.
Recommended	Belgiumwhere written	CyberFundamentals 2025, EssentialCentre for Cybersecurity Belgium · read 29 Aug 2026	What the Belgian centre sets out for the heaviest of its assurance levels, and the only place in this record where a national authority names the insider as something the detection tools are there to catch.	Insider threat awareness and reporting are to be included in the security training, by name, so that people can recognize and respond to internal risks. What the training covers is set out: how to recognize the behavioral signs, what an insider threat is, how and where to report suspicious activity and why reporting in time matters, and real cases or simulations used to show what an insider event costs. It reaches all staff, at onboarding and in the regular training, with an annual refresher.
Recommended	Irelandwhere written	Cyber Security Baseline Standards, Revision 1National Cyber Security Centre and Department of the Environment, Climate and Communications · read 5 Oct 2026Guidance on Cyber Governance for Management Board Members in NIS2 entitiesNational Cyber Security Centre · read 5 Oct 2026	For Public Service Bodies, that an access control policy on least privilege is defined and communicated, that a joiner, mover, leaver policy revokes access no longer required, that user permissions are reviewed monthly and on role change and privileged accounts on a defined schedule, that logging is enabled with a monitoring capability able to tie a user to suspicious activity, and that awareness training is mandatory for all staff.	For Public Service Bodies, cyber security awareness training and education is mandatory for all staff, ongoing and planned, with regular updates on policies and procedures relevant to their roles. The management body follows training sufficient to identify risks and assess risk management practices, and offers similar training to employees on a regular basis.
Recommended	Netherlandswhere written	Baseline Informatiebeveiliging Overheid 2, versie 1.3Nederlandse overheid · read 29 Aug 2026	The government measures Dutch public bodies add on top of the two information security standards, among them a screening policy, a detection use case named in the text, and a log retention set against the scenario that an attacker has been inside for a long time.	Everyone using the information systems, employees and contractors alike, has demonstrably completed an awareness training within three months of entering service. Management is to press the importance of it at appointment and at an internal transfer, and in work meetings and personnel discussions, and to encourage it being taken again periodically.
Recommended	Norwaywhere written	NSMs grunnprinsipper for IKT-sikkerhet 2.1Nasjonal sikkerhetsmyndighet · read 29 Aug 2026	A set of principles for securing information systems, with the monitoring ones carrying what the collected data may be used for, what employees are to be told about it, and the requirement to verify that the collection is working.	Real cases from the handling of incidents are to be used in the training and the raising of awareness of staff, and the results of an evaluation are shared with those they concern.
Recommended	United Kingdomwhere written	Insider Risk Mitigation Digital LearningNPSA · read 12 Aug 2026	The mitigation framework taught in nine modules, with governance and leadership set as the foundation of personnel security.	Awareness is delivered as a course rather than a notice, in modules of ten to twenty minutes, with governance and leadership taught before the controls.