> For the complete documentation index, see [llms.txt](https://docs.glesys.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.glesys.com/security/annex-information-security/9.-basic-cyber-hygiene-and-security-training.md).

# 9. Basic Cyber Hygiene and Security Training

9.1 Glesys maintains baseline security practices and awareness expectations for personnel and extends awareness requirements to direct suppliers and service providers where appropriate, including but not limited to:

a) structured routines for cybersecurity awareness that address e.g. prevailing cyber threats and applicable risk management measures;

b) appropriate and recurring training for all employees and contractors, including introduction training and annual refreshers on information classification, handling requirements and reporting;

c) strong authentication requirements, including multi-factor authentication for accessing relevant systems and enhanced protections for privileged accounts; and

d) requirements for patching, encryption, firewall use, malware protection, device registration (including BYOD), and incident reporting for lost or compromised devices.

9.2 Glesys routines are periodically reviewed and updated to reflect developments in the threat landscape and Glesys' operational environment.

9.3 Glesys periodically evaluates and, where necessary, revises its training activities to ensure that they remain aligned with the prevailing threat landscape, technological developments and any updates to Glesys' security policies.