Principle: B6 Staff awareness and training

Overview

To achieve this outcome, you need to demonstrate that your organisation actively promotes a positive culture around cyber security and information governance (IG).

Positive information assurance culture

You should promote a positive culture around cyber security and information governance (IG) across your organisation. Staff members should understand that protecting information, systems and networks is a shared responsibility and an important part of delivering safe and effective services. 

Your culture should encourage staff to raise concerns, report incidents, breaches and near misses, and identify opportunities for improvement. Staff should feel confident that issues will be taken seriously, investigated appropriately and used to strengthen your organisation's approach to information assurance. 

A positive information assurance culture should support the effective implementation of your policies, processes and procedures. It should promote openness, learning and continuous improvement, helping your organisation improve its security posture and maintain the support and engagement of staff members in protecting essential functions

NHS England has published a just culture guide for information governance and cyber security to help health and care organisations assess whether they are meeting the requirements of a just culture. The National Cyber Security Centre (NCSC) have published a set of cyber security culture principles to support organisations in creating the right cultural conditions for positive security behaviours.

Executive management

All senior leaders on the board, including clinical leaders, must take an active interest in cyber security and IG matters, and act as role models for positive attitudes, behaviours and expectations around information assurance.

Examples of this include:

• regularly discussing cyber security and IG matters at board-level
• sponsoring local campaigns
• supporting improvement initiatives
• addressing incidents and problems openly and consistently

Staff members

All staff members should understand the contribution they make to the security and governance of your information, systems and networks, including their obligation to handle information responsibly and their personal accountability for deliberate or avoidable breaches.

In relation to your information assurance policies, processes and procedures, staff members should understand: 

• why they have a duty to follow them
• who they can speak to for direction (for example, your IT team or Caldicott Guardian)
• where they can find relevant documentation (for example, the location on your intranet where all policies, processes and procedures are stored)

Raising issues

Your staff members should have sufficient knowledge to enable them to identify breaches, near misses and unacceptable behaviour and to know the tell-tale signs of what is irregular and what is acceptable behaviour. They should know how they can raise these issues so that they can be investigated.

In your reporting procedures, you should also consider possible conflicts of interest that might compromise your organisation’s response to reports. For example, incidents being reported via an IT service desk where the staff managing the incident system also manage major systems that are likely to come into focus during an incident investigation (such as a Patient Administration System or Windows Active Directory administrator).

Identifying and addressing culture problems 

You should identify and address factors that prevent staff members from behaving in a way that supports your intended information assurance outcomes.  

This may include barriers created by technology, processes, organisational culture, operational pressures or gaps in knowledge and understanding.  

Health organisations could identify inhibiting factors through: 

• incident, breach and near-miss investigations 

• staff surveys and feedback exercises 

• cyber security and IG training evaluations 

• lessons learned from audits and spot checks 

• focus groups with clinical and operational staff 

• analysis of repeat policy breaches 

• service desk requests and complaints 

• staff suggestions and speaking-up channels 

• reviews of local workarounds that have emerged over time 

The aim should be to understand why staff are not behaving in the intended way, rather than simply identifying that negative information assurance behaviours exist. 

Supporting evidence

To support your response, you can upload (or link to) evidence which best demonstrates your achievement of the contributing outcome. Examples include:

• evidence of executive management endorsements and communications promoting the importance of a positive culture around information assurance 
• list of all staff members and the relevant training, communications and procedures they have access to 
• procedures for raising security issues 
• procedures for informing staff where to find important cyber security and IG related information and contacts
• documentation showing information governance priorities and objectives 
• evidence of campaigns and initiatives showing positive security governance attitudes, behaviours and expectations from executive management
• evidence of encouragement of positive staff treatment following reports of security issues 
• evidence of concerns being taken seriously, recognition of positive behaviours and protection from retaliations being incorporated into procedures for raising concerns 
• evidence of activities to promote information assurance awareness

This is not an exhaustive list. You're welcome to provide other types of evidence if you feel they are relevant to the contributing outcome.

Your supporting statement should cross-reference how each piece of evidence provides justification for your achievement of the contributing outcome, including relevant page numbers where appropriate. 

Interpreting indicators of good practice

National services  

The following national services may help you meet the requirements of B6.b Training: 

• Training services | Board training 

• Training services | SIRO training 

• Training services | Cyber Incident Response Exercise (CIRE) 

• Training services | Keep IT Confidential 

• NCSC services | Exercise in a box 

Additional guidance

For additional guidance, see:

National Cyber Security Centre CAF guidance | B6 Staff awareness and training
National Cyber Security Centre | Cyber security culture principles 
NHS England | A just culture guide for information governance and cyber security
Information Commissioner’s Office | Training and awareness

Overview

This outcome is about ensuring that a range of approaches to information assurance training, awareness and communications are employed to equip staff members with an appropriate level of understanding and awareness.

Information assurance training paths

You should undertake activities to understand the level of training and awareness needed by all staff member groups to protect information, systems and networks while performing their contractual duties.

All staff working in a health and care organisation need some understanding of confidentiality, information governance (IG) and cyber security. They need to understand their obligation to handle information responsibly and their personal accountability for deliberate or avoidable breaches. 

The level of training will vary depending on the staff member’s role, for example:

• a staff member with routine access to employee or confidential health and care information needs to understand how to protect and handle it appropriately to ensure it is accurate and available when needed
• researchers and senior health professionals need a more advanced understanding of what they can and cannot lawfully do with confidential health and care information
• a staff member using a digital device such as a personal computer (PC), tablet or smartphone needs to be aware of their responsibilities to protect information from cyber risks - this includes staff working in areas such as facilities and estates
• a staff member who unintentionally comes across confidential information, for example by overhearing a conversation or seeing sensitive details displayed in a work area, needs to understand how to respond appropriately
• staff members whose roles require additional data security and protection training such as information governance staff or data protection officers 

Training needs analysis

A way of formalising and documenting your training requirements is a training needs analysis (TNA). You can use any appropriate method for your analysis and record it in any format you choose.

Your TNA (or equivalent document) should:

• assess the level of training appropriate for each staff group
• plan resources needed to deliver training
• deliver role-specific training
• identify and address potential gaps in the delivery of training

The DSPT provides an example TNA template for you to refer to if you are creating one for the first time.

Tracking and refreshing training activities

Your training requirements should also be iterative. As your organisation completes one cycle of training, your TNA (or equivalent document) should be reviewed and updated to reflect new national requirements, refinements in the delivery of training based on staff feedback, or changes within your organisation that impact the TNA.

As part of the TNA, you should consider the frequency of training appropriate for each role. For example: 

• on joining your organisation and annually thereafter
• different refresher intervals for different roles

You are free to decide what is appropriate, provided it meets the outcome of staff having and retaining the necessary understanding for their role.

Information and good practice guidance

You may develop your own information and good practice guidance for staff members to follow, or alternatively you may use resources provided by DHSC, NHS England and other national organisations.

These include:

• NHS England's IG portal
• NHS England cyber and data security services and resources
• NCSC guidance and resources
• ICO UK GDPR guidance and resources

Supporting evidence

To support your response, you can upload (or link to) evidence which best demonstrates your achievement of the contributing outcome. Examples include:

• documented training and awareness activities for all staff roles
• procedures for considering and approving training methods
• evidence of easily available information assurance information
• evidence of specific training goals, skills, knowledge being identified
• procedures for tracking and refreshing individuals’ training cycles
• procedures for evaluating effectiveness of training and awareness activities
• evidence of good practice guidance being made available on key topics and used by staff members

This is not an exhaustive list. You're welcome to provide other types of evidence if you feel they are relevant to the contributing outcome.

Your supporting statement should cross-reference how each piece of evidence provides justification for your achievement of the contributing outcome, including relevant page numbers where appropriate. 

Interpreting indicators of good practice

National services

The following national services may help you meet the requirements of B6.a Culture:

• Training services | SIRO training 

• Training services | Cyber Incident Response Exercise (CIRE) 

• Training services | Immersive labs 

• Training services | Keep IT Confidential 

• NCSC services | Exercise in a box 

Additional guidance

For additional guidance, see:

National Cyber Security Centre CAF guidance | B6 Staff awareness and training
National Cyber Security Centre | Guidance and resources
NHS England | NCSC assured training
NHS England | NCSC assured cyber security for SIROs
NHS England | Immersive labs online cyber security e-learning
NHS England | IG portal
NHS England | Cyber and data security services and resources
Information Commissioner’s Office | Guidance and resources
Information Commissioner’s Office | Training and awareness