# HR-03 Security Training and Awareness Programme

- Domain: HR – Personnel
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/hr-03/

## Basic criterion

### HR-03.01B

The cloud service provider operates a target group-oriented security awareness and training programme.

**Supplementary information:**

The target groups may be defined considering job function, job position and the associated risk classification. Target groups serve to simplify and systematise the security training and awareness programme.

### HR-03.02B

All internal and external personnel of the cloud service provider undergoes a role-based training programme regularly and when changing job function, taking into consideration at least the risk classification and technical responsibilities of their position.

### HR-03.03B

The programme is regularly updated based on changes to policies and procedures and the current threat situation and includes the following aspects insofar as they are applicable to each personnel's role:

1. Handling system components used to provide the cloud service in the production environment in accordance with applicable policies and procedures;
2. Handling cloud service customer data, cloud service derived data, cloud service provider data and account data in accordance with applicable policies and procedures and applicable legal and regulatory requirements;
3. Information about the current threat situation;
4. Correct behaviour in the event of security incidents;
5. Security best practices; and
6. Secure development.

### HR-03.04B

The learning outcomes achieved through the awareness and training programme are measured and evaluated.

## Additional criterion

### HR-03.02AS (additional, sharpens 02B)

All internal and external personnel of the cloud service provider undergoes a role-based training programme at least annually and when changing job function, taking into consideration at least the risk classification and technical responsibilities of their position.

### HR-03.01AC (additional, complementing)

The cloud service provider monitors the completion of the security awareness and training programme.

### HR-03.02AC (additional, complementing)

Timely and appropriate remediation measures address any deviations identified during monitoring.

### HR-03.03AC (additional, complementing)

The learning outcomes achieved through the awareness and training programme are measured and evaluated in a target group-oriented manner.

**Supplementary information:**

The measurement and evaluation of learning outcomes in a target group-oriented manner, as specified by the additional criterion, do not require assessing each member of the personnel individually. Instead, evaluations can be performed at an aggregated level, focusing on the overall effectiveness of the training program for specific target groups. This approach allows for the identification of trends and areas for improvement within the program while respecting the personnel's privacy requirements.

### HR-03.04AC (additional, complementing)

The measurements cover quantitative and qualitative aspects.

### HR-03.05AC (additional, complementing)

The results are used to improve the awareness and training programme.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Further specified frequency of personnel undergoing training by requiring it to additionally be undergone when changing job functions as well.

Extend aspects to be included in the awareness and training programm by security best practices and secure development.

Added requirement regarding the measurement and evaluation of the awareness and training programmes.

Bullet points are now sorted to ease discussions about specific list items.

**Additional criterion:**

Added additional requirement that the awareness programme is not just undegone regularly, but yearly.

Added requirement regarding the monitoring of the awareness and training programme through the cloud service provider.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.