Training should cover practical examples, use case studies, and provide information on how to comply with policies.

Up-to-date records including logs of training and completion dates should be maintained.

Training should be broad, high level, and not role-specific in order to reach the largest audience.

Training should cover the consequences of not complying with policies and procedures.

Training should always be provided by an independent third party.