HR-03 Security Training and Awareness Programme
Changed since C5:2020
Basic criterion
Further specified frequency of personnel undergoing training by requiring it to additionally be undergone when changing job functions as well.
Extend aspects to be included in the awareness and training programm by security best practices and secure development.
Added requirement regarding the measurement and evaluation of the awareness and training programmes.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Added additional requirement that the awareness programme is not just undegone regularly, but yearly.
Added requirement regarding the monitoring of the awareness and training programme through the cloud service provider.
Wording in C5:2020
Basic criterion
The Cloud Service Provider operates a target group-oriented security awareness and training program, which is completed by all internal and external employees of the Cloud Service Provider on a regular basis. The program is regularly updated based on changes to policies and instructions and the current threat situation and includes the following aspects:
- Handling system components used to provide the cloud service in the production environment in accordance with applicable policies and procedures;
- Handling cloud customer data in accordance with applicable policies and instructions and applicable legal and regulatory requirements;
- Information about the current threat situation; and
- Correct behaviour in the event of security incidents.
Additional criterion
The learning outcomes achieved through the awareness and training programme are measured and evaluated in a target group-oriented manner. The measurements cover quantitative and qualitative aspects. The results are used to improve the awareness and training programme.
Basic criterion
The cloud service provider operates a target group-oriented security awareness and training programme.
Supplementary information
The target groups may be defined considering job function, job position and the associated risk classification. Target groups serve to simplify and systematise the security training and awareness programme.
All internal and external personnel of the cloud service provider undergoes a role-based training programme regularly and when changing job function, taking into consideration at least the risk classification and technical responsibilities of their position.
The programme is regularly updated based on changes to policies and procedures and the current threat situation and includes the following aspects insofar as they are applicable to each personnel's role:
- Handling system components used to provide the cloud service in the production environment in accordance with applicable policies and procedures;
- Handling cloud service customer data, cloud service derived data, cloud service provider data and account data in accordance with applicable policies and procedures and applicable legal and regulatory requirements;
- Information about the current threat situation;
- Correct behaviour in the event of security incidents;
- Security best practices; and
- Secure development.
The learning outcomes achieved through the awareness and training programme are measured and evaluated.
Additional criterion
HR-03.02AS
Additional, sharpens02BAll internal and external personnel of the cloud service provider undergoes a role-based training programme at least annually and when changing job function, taking into consideration at least the risk classification and technical responsibilities of their position.
HR-03.01AC
Additional, complementingThe cloud service provider monitors the completion of the security awareness and training programme.
HR-03.02AC
Additional, complementingTimely and appropriate remediation measures address any deviations identified during monitoring.
HR-03.03AC
Additional, complementingThe learning outcomes achieved through the awareness and training programme are measured and evaluated in a target group-oriented manner.
Supplementary information
The measurement and evaluation of learning outcomes in a target group-oriented manner, as specified by the additional criterion, do not require assessing each member of the personnel individually. Instead, evaluations can be performed at an aggregated level, focusing on the overall effectiveness of the training program for specific target groups. This approach allows for the identification of trends and areas for improvement within the program while respecting the personnel's privacy requirements.
HR-03.04AC
Additional, complementingThe measurements cover quantitative and qualitative aspects.
HR-03.05AC
Additional, complementingThe results are used to improve the awareness and training programme.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources