A user training program is a formal educational program, often mandatory for some or all employees, that teaches corporate security policies and ways to avoid threats such as social engineering attacks. section 11.2.2
Use user training to help employees:
- Recognize deceptive tactics such as phishing and other social engineering attacks. section 11.2.2
- Respond appropriately to attempts to obtain confidential information or trigger unsafe actions. section 11.6
- Follow corporate security policies through dedicated educational sessions. section 11.2.2
Do not confuse user training with user awareness. Awareness uses reminders or simulated phishing messages to keep threats visible; training provides structured instruction. Physical access control is a separate security program element. section 11.2.2
