Policy 7230A - Department of Administration

provided to all users responsible for the administration and maintenance of a
system:
3.2.2.a Positional Roles Requiring Security Operations Training
• The following roles types, at a minimum, require security
operations training:
o Roles with application implementation and/or
administration responsibilities.
o Roles with server implementation and/or
administration responsibilities.
o Roles with desktop/laptop implementation and/or
administration responsibilities.
o Roles with network infrastructure implementation
and/or administration responsibilities.
o Roles with storage infrastructure implementation
and/or administration responsibilities.
o Roles with security infrastructure implementation
and/or administration responsibilities.
3.2.2.b Security Operations Training Frequency and Scheduling
• Security operations training shall be provided for all
employees with security operations responsibilities within 90
days of commencement of employment.
• Security operations training shall be provided for all
employees with security operations responsibilities within 90
days of the deployment of a new or significantly revised
system. Where possible, employees will be trained together as
groups.
• Security operations training shall be provided thereafter for all
employees with security responsibilities on an at least annual
basis. Where possible, employees will be trained together as
groups.
3.3. Maintain Records
Capture documentation appropriate to all training processes:
• Document and retain copies of employee completion of security awareness
training.
• Document and retain copies of employee completion of security operations
training.
Mandatory Baselines
Page 6 of 25