SOC 2 security awareness training, built from your policies

The slides

13 topic slides between the title, agenda, quiz and closing slides. The reference after each bullet is the policy and statement number it comes from; the speaker notes quote each statement in full.

1. Slide 1

   Northwind Cloud Inc: Security Awareness Training

   • For everyone with access to Northwind Cloud Inc systems: within 30 days of starting, then every year.
   • Presented by the Security Owner, Dana Whitfield, CTO.

2. Slide 2

   Agenda

   Why security matters to our customers · Acceptable use of company systems · Passwords and multi-factor authentication · Device security · Phishing and social engineering · Data classification · Handling data day to day · Reporting incidents · Remote work · Using AI tools · Role changes and leaving · Where to find the policies · Your acknowledgment · Knowledge check

3. Slide 3

   Why security matters to our customers

   • Customers trust Northwind Cloud Inc with their data when they use Northwind.
   • The program exists to protect the confidentiality, integrity and availability of customer data and company systems. (P01 4.2)
   • Northwind Cloud Inc states its security commitments in its terms, privacy notice, security page and customer contracts. (P01 4.12)
   • The policies set the minimum security requirements for Northwind Cloud Inc, and every person follows the ones that apply to them. (P01 4.1)
   • Reporting in good faith never results in disciplinary action, even when the reporter caused the problem. (P01 4.10)

   Sources: P01 Information Security Policy

4. Slide 4

   Acceptable use of company systems

   • Company systems, accounts and devices are provided for the business of Northwind Cloud Inc. (P02 4.1)
   • Accounts are personal: never share passwords, session cookies, multi-factor codes or hardware keys, and never sign in as someone else. (P02 4.2)
   • Install software only from official sources or the approved list, and never disable endpoint protection, disk encryption or other security controls. (P02 4.8)
   • The following are prohibited: bypassing or testing security controls without written authorization from the Security Owner. (P02 4.9)

   Sources: P02 Acceptable Use Policy

5. Slide 5

   Passwords and multi-factor authentication

   • Multi-factor authentication is required on every Northwind Cloud Inc workforce account, with no exception for seniority. (P04 4.2)
   • Passwords chosen by people are at least 14 characters, with no maximum below 64 and no mandatory character-class rules. (P04 4.4)
   • Passwords are not rotated on a fixed schedule; they are changed immediately when compromise is suspected, when they appear in a breach. (P04 4.4)
   • All work credentials are generated and stored in 1Password, provisioned for every person at onboarding. (P04 4.5)
   • Personnel never approve an authentication prompt they did not initiate; an unexpected prompt is reported to security@northwindcloud.example. (P02 4.3)

   Sources: P04 Authentication and Password Policy; P02 Acceptable Use Policy

6. Slide 6

   Device security

   • Company devices are managed with Kandji. Never remove or bypass its enrollment.
   • Full-disk encryption (FileVault on macOS, BitLocker on Windows, LUKS on Linux and platform encryption on mobile devices) is enabled on every endpoint. (P19 4.4)
   • Endpoints lock automatically after no more than 10 minutes of inactivity and require a password, passphrase or biometric to unlock. (P19 4.5)
   • Updates install automatically; critical and high security updates are applied within 7 days. (P19 4.6)
   • Customer data and production datasets are not stored on endpoints. (P19 4.10)

   Sources: P19 Endpoint and Workstation Security Policy

7. Slide 7

   Phishing and social engineering

   • Report suspicious messages and phishing attempts to security@northwindcloud.example as soon as you notice them. (P02 4.13)
   • Verify unexpected requests for money, credentials or data through a second channel before acting. (P02 4.10)
   • Never share passwords, one-time codes or security keys with anyone, including people claiming to be Northwind Cloud Inc leadership. (P04 4.6)
   • Requests arriving by email or chat alone are never actioned. (P04 4.10)

   Sources: P02 Acceptable Use Policy; P04 Authentication and Password Policy

8. Slide 8

   Data classification

   • Information has four levels: Public, Internal, Confidential and Restricted. (P06 4.1)
   • Northwind Cloud Inc handles personal data (PII) for its customers.
   • Restricted covers all customer data, credentials and encryption keys. (P06 4.1)
   • The person who creates or first receives information classifies it; where unclear, the higher level applies until the Security Owner decides. (P06 4.2)
   • Requests from individuals to access, correct or delete their data are routed to the Security Owner within one business day. (P06 4.8)

   Sources: P06 Data Classification and Handling Policy

9. Slide 9

   Handling data day to day

   • Customer, Confidential and Restricted data stay in approved systems: never personal email, personal cloud storage, removable media or unapproved tools. (P02 4.5)
   • Customer data lives only in the production environment and its managed backups, never on laptops, in chat, in tickets or in personal storage. (P06 4.3)
   • Production customer data is not copied into development, staging, test or analytics environments. (P06 4.6)
   • Share Confidential or Restricted information externally only under a signed agreement, through approved channels, with the owner's approval. (P06 4.7)
   • Information is retained only as long as the Data Retention and Disposal Policy requires and is then securely deleted, wiped or shredded. (P06 4.11)

   Sources: P02 Acceptable Use Policy; P06 Data Classification and Handling Policy

10. Slide 10

    Reporting incidents

    • Security Owner: Dana Whitfield, CTO. Ask them when you are not sure whether something is an incident.
    • Anyone who observes or suspects a security incident must report it to security@northwindcloud.example within one hour of discovery. (P13 4.1)
    • Good-faith reports are never penalized, even where the reporter caused the incident. (P13 4.1)
    • Only Executive Management or its designate talks to customers, the press or regulators about an incident; never confirm, deny or speculate. (P13 4.7)
    • The loss, theft or suspected compromise of any endpoint is reported to security@northwindcloud.example within one hour of discovery. (P19 4.12)

    Sources: P13 Incident Response Policy; P19 Endpoint and Workstation Security Policy

11. Slide 11

    Remote work

    • Personnel follow a clear desk and clear screen practice. (P21 4.4)
    • Company devices are never left unattended in public places, in vehicles or in unsecured shared spaces. (P21 4.5)
    • At home, keep screens out of view of household members and visitors, and use headphones where others could overhear. (P21 4.6)
    • Home networks used for work are protected with WPA2 or WPA3 encryption and a strong, non-default Wi-Fi password. (P21 4.7)
    • On public or untrusted Wi-Fi, reach production, admin consoles or customer data only through the company VPN or approved proxy. (P21 4.8)

    Sources: P21 Physical and Remote Work Security Policy

12. Slide 12

    Using AI tools

    • Ask the Security Owner, Dana Whitfield, CTO, before using a new AI tool, extension or service.
    • AI assistants, code generation tools and similar services are used only if they are on the approved tool list. (P02 4.6)
    • Customer data, secrets, personal data and unreleased code go into an AI tool only after the Security Owner confirms its terms in writing. (P02 4.6)
    • Code generated by AI assistants or copied from external sources is reviewed to the same standard as human-written code. (P10 4.12)

    Sources: P02 Acceptable Use Policy; P10 Secure Software Development Policy

13. Slide 13

    Role changes and leaving

    • When a person changes role, team or manager, their access is reviewed against the new role's profile within five business days. (P18 4.5)
    • When you leave, your accounts are disabled and sessions revoked by the end of your last working day. (P18 4.6)
    • Company devices are returned on or before the last working day. (P18 4.7)
    • When a person leaves, the vaults they could access are reviewed and any credential they could have read is rotated within one business day of departure. (P18 4.8)

    Sources: P18 Human Resources Security Policy

14. Slide 14

    Where to find the policies

    • The full policy set is at [Fill in: where the policies are published, for example the company wiki].
    • Questions about any policy go to the Security Owner, Dana Whitfield, CTO.
    • Northwind Cloud Inc maintains a written information security program consisting of this policy and the supporting policies in the policy register. (P01 4.1)
    • Deviations from any policy require a documented exception under section 6; undocumented deviations are policy violations. (P01 4.13)
    • Every policy has a named owner and is reviewed on the annual cycle and after significant changes. (P01 4.5)

    Sources: P01 Information Security Policy

15. Slide 15

    Your acknowledgment

    • All personnel acknowledge this policy and the Acceptable Use Policy in writing at hire, at each annual review and after each material revision. (P01 4.6)
    • No account, device or system access is issued until the signed agreement and the policy acknowledgments are on file. (P18 4.2)
    • All personnel complete security awareness training within 30 days of starting and at least every 12 months thereafter. (P18 4.4)
    • Violations of security policy are handled through a formal disciplinary process that is proportionate, documented and consistent. (P18 4.11)
    • Sign the acknowledgment form, complete the quiz, and your dates go in the training tracker.

    Sources: P01 Information Security Policy; P18 Human Resources Security Policy

16. Slide 16

    Knowledge check

    • 12 multiple-choice questions; every answer is a statement in our policies.
    • Use the quiz handout; the answer key is on its own page for the presenter.
    • Pass mark: [Fill in: pass mark set by the Security Owner, for example 80 percent].
    • Each score and pass result goes in the training tracker.

17. Slide 17

    Questions and next steps

    • Questions about security or the policies: Dana Whitfield, CTO, Security Owner.
    • Report incidents, phishing and lost devices: security@northwindcloud.example.
    • Sign the policy acknowledgment and hand in the quiz today.
    • Next training: every year, and whenever a policy changes materially.

The quiz

12 questions. Each correct answer is stated in one of the policies, and each wrong answer is something the same statement rules out. Open a question to see the answer and its source.

1. 1. You suspect a security incident. What does the Incident Response Policy require you to do?

   • A. Investigate it yourself first and report it only once it is confirmed
   • B. Report it to security@northwindcloud.example within one hour of discovery
   • C. Mention it at the next weekly team meeting
   • D. Include it in the quarterly security report within 30 days
   Answer and source

   B. Report it to security@northwindcloud.example within one hour of discovery

   P13 Incident Response Policy, statement 4.1: “Anyone who observes or suspects a security incident must report it to security@northwindcloud.example within one hour of discovery. Good-faith reports are never penalized, even where the reporter caused the incident.”

2. 2. Your phone shows a sign-in approval prompt that you did not start. What do you do?

   • A. Approve it so the prompts stop
   • B. Ignore it, because prompts expire on their own
   • C. Approve it if it arrives during working hours
   • D. Do not approve it, and report it to security@northwindcloud.example
   Answer and source

   D. Do not approve it, and report it to security@northwindcloud.example

   P02 Acceptable Use Policy, statement 4.3: “Every account that supports multi-factor authentication has it enabled. Personnel never approve an authentication prompt they did not initiate; an unexpected prompt is reported to security@northwindcloud.example.”

3. 3. Which accounts need multi-factor authentication?

   • A. Every workforce account, with no exception for seniority
   • B. Only administrator accounts
   • C. Only accounts used outside the office
   • D. Every account except those of executives
   Answer and source

   A. Every workforce account, with no exception for seniority

   P04 Authentication and Password Policy, statement 4.2: “Multi-factor authentication is mandatory for every workforce account at Northwind Cloud Inc, without exception for seniority. Administrative accounts in Okta, the identity services of AWS and Vercel and GitHub use phishing-resistant methods such as FIDO2 security keys or passkeys; authenticator applications are acceptable elsewhere. SMS and voice codes are permitted only where no other method is offered and are recorded as an exception.”

4. 4. Where do you store work passwords?

   • A. In the browser's built-in password saving
   • B. In a spreadsheet in your personal folder
   • C. In 1Password
   • D. In a notes app, as long as the laptop is encrypted
   Answer and source

   C. In 1Password

   P04 Authentication and Password Policy, statement 4.5: “All work credentials are generated and stored in 1Password, provisioned for every person at onboarding. Passwords are not stored in browsers, spreadsheets, notes, chat or email, and the password manager's master password is a strong, unique passphrase protected by multi-factor authentication.”

5. 5. What is the minimum length of a password you choose yourself?

   • A. At least 8 characters, with a symbol and a number
   • B. Exactly 12 characters
   • C. At least 14 characters
   • D. Any length, as long as it contains a capital letter
   Answer and source

   C. At least 14 characters

   P04 Authentication and Password Policy, statement 4.4: “Passwords chosen by people are at least 14 characters, with no maximum below 64 and no mandatory character-class rules. They are checked against known-breached password lists at creation and periodically and rejected if they appear. Passwords are not rotated on a fixed schedule; they are changed immediately when compromise is suspected, when they appear in a breach, or when a person who knew a shared secret leaves.”

6. 6. Someone who says they are from Northwind Cloud Inc leadership asks you for a one-time code by chat. What do you do?

   • A. Refuse: passwords, one-time codes and security keys are never shared with anyone
   • B. Share it, because leadership can approve exceptions
   • C. Share it if the person is in your team's channel
   • D. Share it once, then change your password
   Answer and source

   A. Refuse: passwords, one-time codes and security keys are never shared with anyone

   P04 Authentication and Password Policy, statement 4.6: “Work passwords are never reused across systems or as personal passwords. Personnel never share passwords, one-time codes or security keys with anyone, including colleagues, support staff or people claiming to be from Northwind Cloud Inc leadership.”

7. 7. An urgent email that looks like it comes from a vendor asks you to change their bank details. What does the policy require?

   • A. Act on it if the email signature looks right
   • B. Reply to the same email to confirm
   • C. Act on it first and verify later, because it is urgent
   • D. Verify the request through a second channel before acting
   Answer and source

   D. Verify the request through a second channel before acting

   P02 Acceptable Use Policy, statement 4.10: “Personnel verify unexpected requests for money, credentials or data through a second channel before acting, do not auto-forward company mail to external addresses, and share documents externally only through approved systems with the narrowest audience that gets the job done.”

8. 8. Which classification level applies to customer data?

   • A. Public
   • B. Restricted
   • C. Internal
   • D. Confidential
   Answer and source

   B. Restricted

   P06 Data Classification and Handling Policy, statement 4.1: “Northwind Cloud Inc classifies information into four levels. Public is approved for release to anyone. Internal is routine business information whose disclosure would cause limited harm. Confidential is information whose disclosure would harm Northwind Cloud Inc, its personnel or its partners, such as financial records, contracts, personnel data, source code and security configurations. Restricted is information whose disclosure would seriously harm customers or Northwind Cloud Inc or breach a legal or contractual obligation, including all customer data processed by Northwind, all PII data, credentials and encryption keys, and security incident details.”

9. 9. May you copy customer data to your personal cloud storage to work on it at home?

   • A. Yes, if the folder is password-protected
   • B. No. It stays inside approved systems and is never copied to personal storage
   • C. Yes, for up to one week
   • D. Yes, if you delete it afterward
   Answer and source

   B. No. It stays inside approved systems and is never copied to personal storage

   P02 Acceptable Use Policy, statement 4.5: “Customer data and Confidential or Restricted information, as defined in the Data Classification and Handling Policy, stay inside approved systems and are never copied to personal email, personal cloud storage, removable media, screenshots, chat messages or unapproved tools.”

10. 10. May you paste customer data into an AI assistant?

    • A. Yes, any widely used AI assistant is fine
    • B. Yes, if you remove the customer's name first
    • C. Yes, if you use your personal account
    • D. Only if the Security Owner has confirmed in writing that the tool's data handling terms permit it
    Answer and source

    D. Only if the Security Owner has confirmed in writing that the tool's data handling terms permit it

    P02 Acceptable Use Policy, statement 4.6: “AI assistants, code generation tools and similar services are used only if they are on the approved tool list. Customer data, secrets, personal data and unreleased source code are not entered into any AI tool unless the Security Owner has confirmed in writing that its data handling terms permit it.”

11. 11. Your work laptop is stolen. What does the policy require?

    • A. Report it to security@northwindcloud.example within one hour of discovery
    • B. Wait a few days in case it turns up
    • C. Buy a replacement and mention it at your next review
    • D. Change your passwords; no report is needed if the disk is encrypted
    Answer and source

    A. Report it to security@northwindcloud.example within one hour of discovery

    P19 Endpoint and Workstation Security Policy, statement 4.12: “The loss, theft or suspected compromise of any endpoint is reported to security@northwindcloud.example within one hour of discovery, as the Incident Response Policy requires. Lost devices are locked and wiped remotely through Kandji, and the Incident Response Policy applies.”

12. 12. When must security awareness training be completed?

    • A. Once, at some point during the first year
    • B. Only when a policy changes
    • C. Within 30 days of starting, and at least every 12 months after that
    • D. Within 180 days of starting, then every 36 months
    Answer and source

    C. Within 30 days of starting, and at least every 12 months after that

    P18 Human Resources Security Policy, statement 4.4: “All personnel complete security awareness training within 30 days of starting and at least every 12 months thereafter. Engineers also complete secure development training covering the OWASP Top 10, secrets handling and change management. Personnel who handle personal data complete data protection training on lawful processing, data subject rights and breach reporting.”