What it asks for. This Protect category asks that staff are given cybersecurity awareness and training so they can carry out their duties with security risks in mind. CSF 1.1 also called out privileged users, third parties, senior executives and security personnel specifically, and CSF 2.0 keeps the category with general and role specific training.
In practice. Everyone receives baseline awareness training, while privileged users, developers, executives and security staff receive training suited to their roles. Third parties with access understand their responsibilities. Effectiveness is measured, for example through simulations and reporting behaviour. Evidence includes training plans, completion records and measurement results.
Common gaps. Training is often one size fits all and measured only by completion. Executives and third parties are frequently excluded, despite being frequent targets.