Policy 06 — Security Training & Awareness Policy

← All 21 policies

This page is the rule, not the implementation. It states what Revique must do, at or above the PCI DSS minimum. How Revique actually does it today — the real AWS configuration, the current values, and where an auditor logs in to verify them — is in Procedure 06. Values shown as [X] are placeholders still to be set.

Purpose

To ensure all personnel understand their security responsibilities and are kept aware of current threats through recurring training.

Scope

Applies to all Revique employees, contractors, and relevant third-party personnel.

Policy statements

Each statement below is mandatory. The bolded must marks the obligation.

1All personnel must complete security awareness training upon joining and at least annually thereafter.

2Training must cover CHD/PHI handling, phishing, password hygiene, and incident reporting.

3Completion of training must be documented and retained as evidence.

4Personnel must be made aware of emerging threats (e.g. phishing campaigns) as needed.

Roles & responsibilities

Role	Responsibility
Security Officer	Define and deliver the training program and track completion.
All Personnel	Complete required training within defined timeframes.

Enforcement

This policy is issued under the authority of Policy 01 — Information Security Policy and is mandatory for everyone in scope. Compliance is verified through the controls and evidence described in the linked procedure. Failure to comply may result in withdrawal of access and disciplinary action. This policy is reviewed at least annually, or sooner on significant change.

⚙️See the Procedure for this policyHow Revique implements this rule today, the current values, the gaps, and the auditor verification path→