What it asks for. Organisations should run a security awareness programme that shapes how staff behave so that they are security conscious and appropriately skilled. It covers general awareness topics and role specific training for those with particular responsibilities.
In practice. A good programme trains all staff at onboarding and at least yearly on topics such as social engineering, authentication, data handling and incident reporting, and adds role based training for developers, administrators and executives. Content is refreshed to reflect current threats, and phishing simulations or other exercises measure behaviour. Evidence includes completion records, training content, simulation results and reporting rates over time.
Common gaps. Programmes often focus on annual completion rates rather than behaviour change, and role based training for privileged users is frequently missing. Staff are seldom told clearly how and where to report a suspected incident.