What it asks for. Point (g) requires basic cyber hygiene practices and cybersecurity training. This covers foundational controls and making sure people understand their part in security.
In practice. The entity enforces hygiene measures such as patching, secure configuration, strong authentication, least privilege, backups and email protection, and runs regular awareness training for all staff with role based content where needed. Training is tracked and its effect measured, for example through phishing simulations and incident reporting rates. Evidence includes hygiene control reports, training plans and completion records.
Common gaps. Training is often limited to an annual module with no measurement of behaviour. Basic hygiene controls may be strong on corporate devices but weak in cloud and OT environments.