TCR-IT-008: Security Awareness & Training Policy

Summary

Establishes TCR’s cybersecurity awareness and training program. Mandatory for all employees; recommended for students.

Why it exists

Most security incidents start with a person, not a system: phishing, weak passwords, or not recognizing a threat. Training the whole community to recognize and respond to threats is a cheaper and more effective defense than relying on technical controls alone.

Policy

Security awareness program

• Annual training: all employees complete annual cybersecurity awareness training (phishing, malware, data protection, password security).
• Student orientation: cybersecurity awareness sessions included in new-student orientation.
• Ongoing education: regular updates on emerging threats and best practices via newsletters.

Training requirements

• IT and cybersecurity staff receive additional, role-specific technical training.
• Departments handling sensitive information or critical infrastructure receive specialized training.

Reporting and response training

• Training covers how to report suspected incidents promptly.
• Key staff are trained on executing the college’s Incident Response Plan.

Compliance and assessment

• The Office of Information Technology tracks training completion for all employees.
• Program effectiveness is evaluated annually via surveys, quizzes, and simulated phishing exercises.

Enforcement

Employees who fail to complete required training may face disciplinary action, including restricted access to TCR’s digital resources.

Roles

• All employees and students: engage in and complete required training.
• IT Systems Coordinator: develops, implements, and annually reviews the program.
• Leadership Team: provides support and resources for effective implementation, ensuring institutional compliance.

Notes

Digitized from TCR-IT-008 - Security Awareness & Training Policy [Rev 1.0].docx; the original is kept under source/policies/ in this repo.