Organisational Policies - Training and Secure Onboarding

The effective application of Chapter 13 - Training and Secure Onboarding - depends on the existence of formal organisational policies that sustain:

• Mandatory minimum training by role and by access;
• Objective validation of knowledge before permissions are granted;
• Traceability of training, even in third-party or outsourcing contexts;
• The integration of training as part of the security lifecycle (SbD).

---

📌 Fundamental note

✅ Training must be treated as a mandatory security control, not as an option or a formality.

---

🧾 Recommended policies

Policy Name	Mandatory	Application	Minimum expected content
Training by Profile Policy	Yes	All staff members with technical roles	Definition of training tracks by role (e.g. Dev, QA, DevOps), with minimum content, sequence and validation
Onboarding Validation Policy	Yes	All new technical members (internal or external)	Mandatory training before technical permissions, quiz, onboarding checklist validated by the responsible team
Third-Party Integration Policy	Yes	Suppliers, contractors and external teams	Responsibility statement, minimum training, validation quiz and record with traceability
Training Content Management Policy	Recommended	AppSec team, Champions and those responsible for training	Modular structure by chapter of the SbD-ToE, versioned templates and artefacts applicable to projects
Training Indicators Policy	Recommended	Security, quality and governance teams	Training coverage KPIs by team, validation metrics, alerts for incomplete or outdated training
Training Update Policy	Optional	AppSec, training team and Champions	Periodic review of content, update after relevant changes (e.g. incidents, changes to the SbD-ToE)

---

✅ Final recommendations

• These policies must be formally approved by security leadership and communicated to the onboarding, training and hiring areas.
• They must be included as a reference in contracts, SLAs, onboarding plans and continuous assessment cycles.
• The systematic adoption of these policies makes training an auditable measure, with a direct impact on the organisation's security maturity and posture.

🛡️ A clear, applied and audited training policy is one of the most effective pillars of incident prevention.