[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-6-3":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-6-3","Annex A 6.3","ISO\u002FIEC 27001:2022 Annex A 6.3: Information security awareness, education and training",12,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects staff and relevant interested parties to receive appropriate awareness, education and training on information security, with regular updates to policies and procedures relevant to their role. The aim is to make sure people understand their security responsibilities and know how to act on them.\n\n**In practice.** Good practice is a programme with general awareness for everyone, role-specific training for groups such as developers, administrators and managers, and onboarding content for new joiners. Content is refreshed as threats and policies change, and effectiveness is measured. Auditors look for a training plan, completion records and evidence that the content matches roles and current risks.\n\n**Common gaps.** Typical gaps are a single annual module for all staff, contractors left out and no measure of whether behaviour actually changes.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"deepfake-voice-cloning-exposes-gaps-in-identity-verification","Deepfake Voice Cloning Exposes Gaps in Identity Verification","2026-10-14T14:22:39.372+00:00",{"slug":23,"title":24,"published_at":25},"employee-fined-for-photographing-and-sharing-patients-sensitive-health-data","Employee Fined for Photographing and Sharing Patients' Sensitive Health Data","2026-10-06T16:20:25.103+00:00",{"slug":27,"title":28,"published_at":29},"deepfakes-shatter-trust-in-visual-identity-verification","Deepfakes Shatter Trust in Visual Identity Verification","2026-10-05T12:20:21.472+00:00",{"slug":31,"title":32,"published_at":33},"shinyhunters-targets-reliaquest-employee-via-fake-sso-page","ShinyHunters Targets ReliaQuest Employee via Fake SSO Page","2026-08-24T16:20:19.169+00:00",{"slug":35,"title":36,"published_at":37},"phishing-attack-on-car-dealership-leads-to-gdpr-fine-for-inadequate-security-measures","Phishing Attack on Car Dealership Leads to GDPR Fine for Inadequate Security Measures","2026-08-21T12:20:57.838+00:00",{"slug":39,"title":40,"published_at":41},"employee-fined-1000-for-sharing-customer-phone-number-without-legal-basis","Employee Fined €1,000 for Sharing Customer Phone Number Without Legal Basis","2026-08-18T10:21:09.428+00:00",{"slug":43,"title":44,"published_at":45},"vishing-group-unc6671-exploits-employee-trust-to-steal-credentials-and-mfa-tokens","Vishing Group UNC6671 Exploits Employee Trust to Steal Credentials and MFA Tokens","2026-08-07T12:20:19.981+00:00",{"slug":47,"title":48,"published_at":49},"shinyhunters-phishing-infrastructure-100-malicious-domains-uncovered","ShinyHunters Phishing Infrastructure: 100+ Malicious Domains Uncovered","2026-07-31T10:20:57.854+00:00",{"slug":51,"title":52,"published_at":53},"italian-ministry-of-justice-fined-for-posting-employee-health-data-on-canteen-bulletin-board","Italian Ministry of Justice Fined for Posting Employee Health Data on Canteen Bulletin Board","2026-07-20T12:20:57.331+00:00",{"slug":55,"title":56,"published_at":57},"scattered-spider-members-jailed-for-29m-transport-for-london-cyberattack","Scattered Spider Members Jailed for £29M Transport for London Cyberattack","2026-07-16T14:20:45.108+00:00",{"slug":59,"title":60,"published_at":61},"polish-municipal-unit-fined-for-employee-data-leak-and-failure-to-report-gdpr-breach","Polish Municipal Unit Fined for Employee Data Leak and Failure to Report GDPR Breach","2026-07-09T14:22:09.682+00:00",{"slug":63,"title":64,"published_at":65},"employee-email-mistake-costs-electricity-company-212-in-gdpr-damages","Employee Email Mistake Costs Electricity Company €212 in GDPR Damages","2026-06-24T10:21:37.436+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",5,{"slug":73,"name":74,"problem":75,"stories":76},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",4,{"slug":78,"name":79,"problem":80,"stories":81},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",3,{"slug":83,"name":84,"problem":85,"stories":86},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":88,"name":89,"problem":90,"stories":86},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":92,"name":93,"problem":94,"stories":95},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",1,[97,102,108,113,118,122,126,130],{"family":98,"item":99,"code":100,"title":101,"together":9},"cis","14","Control 14","Security Awareness and Skills Training",{"family":103,"item":104,"code":105,"title":106,"together":107},"gdpr","32","Article 32","Security of processing",9,{"family":109,"item":110,"code":111,"title":112,"together":107},"nist-800-53","at-2","AT-2","Literacy Training and Awareness",{"family":98,"item":114,"code":115,"title":116,"together":117},"6","Control 6","Access Control Management",6,{"family":98,"item":119,"code":120,"title":121,"together":71},"3","Control 3","Data Protection",{"family":103,"item":123,"code":124,"title":125,"together":71},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":127,"item":128,"code":129,"title":129,"together":76},"itil","overview","ITIL",{"family":109,"item":131,"code":132,"title":133,"together":76},"ac-2","AC-2","Account Management"]