Introduction

Chroma Colors Corporation (Chroma Colors) recognizes that its employees are a critical component of its information security posture. Human error and lack of awareness are significant contributors to security incidents. This Cybersecurity Awareness and Training Policy (hereinafter referred to as "the Policy") establishes the framework for providing all employees, contractors, and relevant third parties with the necessary knowledge and skills to protect Chroma Colors' information assets from cybersecurity threats.

Purpose

The purpose of this Policy is to:

• Ensure that all personnel understand their responsibilities in safeguarding Chroma Colors' information assets.
• Mitigate the risk of cybersecurity incidents arising from human error or malicious intent.
• Promote a security-conscious culture throughout the organization.
• Comply with relevant laws, regulations, and industry standards related to information security.
• Educate personnel on common cybersecurity threats, best practices, and Chroma Colors' security policies and procedures.

Scope

This Policy applies to all Chroma Colors employees (full-time, part-time, temporary), contractors, consultants, interns, and any third-party personnel who have access to Chroma Colors' information systems, networks, or data, regardless of their location or the devices they use to access Chroma Colors' resources.

Policy Statement

Chroma Colors is committed to establishing and maintaining a comprehensive Cybersecurity Awareness and Training Program. All individuals covered by this Policy are required to participate in mandatory security awareness training and adhere to the security best practices and policies communicated therein. Failure to comply with this Policy may result in disciplinary action, up to and including termination of employment or contract.

Responsibilities

Chief Information Officer & CISO

• Develop, implement, and maintain the Cybersecurity Awareness and Training Program.
• Identify training needs based on threat landscape, policy changes, and incident analysis.
• Select appropriate training methodologies, content, and delivery platforms.
• Track and report on training completion rates.
• Review and update training materials regularly (at least annually).
• Serve as a point of contact for cybersecurity-related questions and concerns.
• Integrate cybersecurity awareness training into the new hire onboarding process.
• Support the Information Security Department in communicating training requirements.
• Assist in addressing disciplinary actions for non-compliance with this Policy.
• Promote a security-aware culture within their respective departments.
• Ensure their team members complete mandatory training.
• Support and reinforce cybersecurity best practices.
• Complete all mandatory cybersecurity awareness training within the specified deadlines.
• Adhere to all Chroma Colors' information security policies and procedures.
• Report any suspected cybersecurity incidents, vulnerabilities, or suspicious activities immediately to the Information Security Department via email to [email protected]
• Apply learned security best practices in their daily work activities.
• Ask for clarification if unsure about security procedures or requirements.

Human Resources Department

Management and Department Heads

All Employees, Contractors, and Third Parties

Cybersecurity Awareness and Training Program Components

The Cybersecurity Awareness and Training Program will include, but not be limited to, the following elements:

Training Frequency and Tracking

• Initial Training: To be completed within 14 days of start date via Custom Guide IT Training Portal.
• Annual Refresher Training: To be completed annually, typically within the first quarter of the calendar year or as otherwise specified by the Information Security Department.
• Tracking: The Information Security Department will maintain records of training completion for all personnel. These records will include the names of individuals trained, training dates, and the content covered.
• Ongoing awareness campaigns will be conducted throughout the year to address specific and timely security topics (e.g., current phishing trends, holiday security tips, new policy rollouts). These may include:
  • Email advisories
  • Simulated phishing exercises (see Section 6.5)
  • Short video clips or infographics
• Chroma Colors may periodically conduct simulated phishing exercises to test the effectiveness of training and identify areas for improvement.
• These exercises will be designed to mimic real-world phishing attempts.
• Employees who fall for simulated phishing attempts may be required to complete additional targeted training.
• The results of these exercises will be used for educational purposes and to enhance the training program, not for punitive measures, unless repeated failures indicate willful disregard of policy.

Targeted Awareness Campaigns

Simulated Phishing Exercises

Training Methodology

Training may be delivered through various methods, including:

• Online e-learning modules via IT Training Portal (Custom Guide)
• Instructor-led sessions (in-person or virtual)
• Periodic specialized communications
• Security newsletters and bulletins
• Interactive quizzes and assessments

Policy Review and Updates

This Policy will be reviewed and updated by the Information Security Department at least annually, or more frequently as needed, to ensure its continued relevance, effectiveness, and alignment with changes in the threat landscape, technology, and regulatory requirements.

Policy Enforcement

Compliance with this Policy is mandatory. Non-compliance may result in disciplinary action, up to and including termination of employment or contract, in accordance with Chroma Colors' HR policies. Repeated or severe security policy violations will be addressed through established disciplinary procedures.

Reporting Security Incidents

All personnel are required to immediately report any suspected cybersecurity incidents, vulnerabilities, or suspicious activities to the Information Security Department via the Chroma Colors Helpdesk at [email protected]. Prompt reporting is crucial for effective incident response and mitigation.