GCSB-PRC-TRA-001 Training and Awareness Procedure

Document control

1. Purpose

This procedure tells an adopting organisation exactly who does what, when and how to implement GCSB-ST-CSF-TRA-001. It converts the standard's training requirements (clauses 6.1 to 6.10) into repeatable, auditable steps. It does not change, relax or extend any requirement of the standard; where this procedure and the standard differ, the standard prevails. Organisational training under this procedure is distinct from any individual GCSB recognition, credential or CPD entitlement.

2. Scope and applicability

This procedure applies to every organisation adopting the Training and Awareness Standard, covering its personnel and relevant contractors across cyber, physical and OT domains. The standard follows the extended implementation track of 18 months from certification commencement: gap assessment of existing training systems and baseline competency assessment by month 6, foundation phase complete by month 6, development phase complete by month 12, and full capability by month 18. The 12-month baseline controls and 6-month gap assessment of the Main Standard continue to apply throughout.

3. Roles

4. Procedure

Step 1 - Record the adoption and scope (Week 1)

1. The governing body passes a written adoption decision naming the standard, edition (v2.0) and adoption date.
2. The CCSO records the adoption date in the implementation register. This date starts every clock in this procedure.
3. The adopter confirms the in-scope population: all personnel and relevant contractors across cybersecurity, physical security and OT domains (clause 2).

Record: adoption decision; scope record.

Step 2 - Establish training governance (Month 1)

1. The adopter defines and documents the roles: board-level oversight, CCSO, training governance committee, training administrators, competency assessors and HR/learning owners (clause 5).
2. The training governance committee is established with representation from IT security, physical security, OT, HR and executive leadership, convening at least quarterly to review training effectiveness, assess emerging competency requirements and oversee budget allocation (clause 5).

Record: role definitions; committee terms of reference and calendar.

Step 3 - Cross-functional training programme (Months 1-6, foundation phase)

1. The adopter deploys cross-functional security training programmes integrating cybersecurity, physical security and OT security training across all personnel in scope (clause 6.1).
2. Security awareness programmes deliver role-based security education to all personnel, covering hybrid threat recognition, cross-domain security incidents and integrated response procedures; the adopter defines and documents its own completion-coverage target (clause 6.2).
3. Training content and assessment comply with applicable data protection law, including GDPR, UK GDPR and relevant sector-specific requirements (clause 6.2).
4. The foundation phase completes by month 6 (clause 7).

Record: curricula; awareness programme records; coverage reports.

Step 4 - Gap and baseline competency assessment (by Month 6, binding)

1. The gap assessment of existing training systems and the baseline competency assessment are completed by month 6 (clause 7).
2. The CCSO consolidates findings into a gap register: gap, affected clause, risk rating, interim control, owner, target date.

Record: gap assessment; baseline competency assessment.

Step 5 - Specialised and integrated training (Months 6-12, development phase)

1. Specialised training is provided for personnel in security operations, technical and leadership roles, including incident response, threat analysis, cross-domain security management and competency relevant to technology platforms covered by GCSB-ST-CSF-TIA-001, vendor-neutral and proportionate to the platforms actually deployed (clause 6.3).
2. Where pass-rate or scoring thresholds are set for competency assessment, they are defined, documented and applied consistently, together with the related assessment population and frequency (clause 6.3).
3. Integration between training programmes across security domains is established, enabling coordinated curricula, shared scenarios and consistent competency assessment (clause 6.4).
4. The development phase completes by month 12 (clause 7).

Record: specialised training records; assessment thresholds; integrated curriculum.

Step 6 - Competency framework and assessment (Months 6-12, then recurring)

1. A competency framework covering all security-related roles is implemented, with assessment on appointment and periodic reassessment thereafter (clause 6.5).
2. Pass thresholds, assessment frequency and reassessment cadence are defined and documented, aligned so far as practicable with the access-review cadences the organisation defines under GCSB-ST-CSF-IAM-001; this procedure does not import an annual reassessment duty from that standard (clause 6.5).
3. Any annual continuing-education hours or quarterly training-hour targets are defined and documented by the adopter; illustrative examples are not commitments or guarantees (clause 6.5).

Record: competency framework; assessment and reassessment records.

Step 7 - Exercises and drills (Months 6-18, then recurring)

1. Tabletop exercises and simulation drills validate personnel and organisational response to multi-domain security incidents, using scenarios aligned with GCSB-ST-CSF-IRBC-001 (clause 6.6).
2. Exercises address hybrid incidents affecting both physical and digital domains, systemic incidents involving interconnected system failures, and cascading incidents involving sequential, propagating failures (clause 6.6).
3. Where OT environments are used in drills, appropriate safety controls avoid disruption to live systems (clause 6.6).
4. The adopter defines and documents the exercise frequency and the period of threat-scenario material used to inform exercise design (clause 6.6).

Record: exercise programme; exercise reports; lessons-learned log.

Step 8 - Technology-platform training (Months 6-18)

1. Training on technology platforms within the scope of GCSB-ST-CSF-TIA-001 is vendor-neutral and proportionate to the platforms the organisation actually operates (clause 6.7).
2. Where applicable, training addresses SIEM/PSIM platform operation, zero trust architecture principles and the use of AI/ML in threat detection, at a level proportionate to each individual's role (clause 6.7).
3. Vendor certification maintenance, where adopted as an organisational requirement, is proportionate to role and platform criticality (clause 6.7).

Record: platform training records; role-proportionality justification.

Step 9 - Records, documentation and oversight (Months 6-18, then standing)

1. Documentation evidencing programme operation is maintained: curricula, competency frameworks, delivery records and assessment outcomes (clause 6.8).
2. Personal data within training records is processed in accordance with GCSB-ST-CSF-DPP-001 (clause 6.8).
3. Governance arrangements define roles for training administration, competency assessment and continuous improvement, with regular review of training content for currency with the threat environment and applicable platforms; any target update period following platform changes is defined and documented (clause 6.8).
4. The training governance committee maintains oversight of technology-related training content and its currency (clause 6.9).

Record: training records; content review log; committee minutes.

Step 10 - Effectiveness measurement and completion (by Month 18, binding)

1. The adopter monitors the effectiveness of its training and awareness programmes and applies continual improvement, including review of exercise outcomes, assessment results and identified competency gaps (clause 6.10).
2. Full capability is achieved by month 18 (clause 7).
3. The CCSO verifies every requirement of clauses 6.1 to 6.10 is implemented or covered by an approved exception, and signs the implementation completion declaration.

Record: effectiveness reports; signed completion declaration.

Step 11 - Exceptions (as needed)

1. Deviations require documented business justification and CCSO approval; the CCSO may approve temporary exceptions for up to 12 months (clause 9).
2. Exceptions longer than 12 months require approval by the Board Risk Committee on the recommendation of the Enterprise Risk Management Committee.
3. All exceptions are reviewed at least quarterly.

Record: exception register with quarterly review dates.

5. Records and retention

All records named in this procedure are retained for the period set by the adopter's records policy and the standard's evidence duties, whichever is longer. Personal data in training records is handled per GCSB-ST-CSF-DPP-001. This procedure creates no alternative retention period.

6. Related documents

• GCSB-ST-CSF-TRA-001 v2.0 (parent standard)
• GCSB-ST-CSF-001 Main Standard and GCSB-PRC-CSF-001
• Companion standards: GLA, RMA, TIA, IAM, DPP, IRBC and the CCSO Policy
• GCSB certification procedure (assessment and decision clocks)

Revision history