Security Training & Awareness Log¶
Purpose. The record of who completed which security training or awareness activity, and when (ISO/IEC 27001:2022 7.2, 7.3, control A.6.3; monitoring metric M9). Entries are appended automatically by the
/isms:onboardcommand — each run of the onboarding/refresher adds a row and lands via a PR, so the git history is the audit trail.
Cadence: every team member completes the essentials refresher quarterly; new joiners complete it during onboarding. Material: ESSENTIALS.md (distilled from the approved policy set).
Log¶
| Date | Person | Activity | Material (version) | Method | Notes / questions raised |
|---|---|---|---|---|---|
| 2026-09-08 | Olaf Jacobson | Security essentials refresher (all twelve rules, two incident scenarios) | ESSENTIALS.md, distilled 2026-07-02, at e670eab |
Claude Code /isms:onboard |
Raised three findings: (1) rule 6 did not distinguish source code from customer personal data, and gave no test for whether an AI tool is approved — fixed by promoting the AI rules to Acceptable Use §2.6 and rewriting rule 6 (#72); (2) rule 8 'nobody pushes to main' holds only on soon-server, frontend and soon-terraform — owner decision to scope the control to the principal repositories rather than all six; (3) the quarterly access review has never been run and Melvin Jacobson's remaining access is unreviewed — owner took ownership, scheduled 2026-09-09. Scenarios answered correctly; coaching point on rotating a leaked credential immediately rather than when it reaches production. Rules 9–12 drew no comment. |
| 2026-09-08 | Melvin Jacobson | Security essentials refresher (all twelve rules, two incident scenarios) | ESSENTIALS.md, distilled 2026-07-02, at aa74bad |
Claude Code /isms:onboard |
No findings raised — all twelve rules clear. Scenarios answered correctly; coaching points: (1) report a leaked secret in #Security/#DevOps rather than only a DM, and treat the DM itself as a leaked secret to clean up; (2) rotate an exposed credential immediately regardless of who does it; (3) also log a stolen-device event in #Security in addition to the same-day access revocation. |
How an entry gets here¶
- A team member runs
/isms:onboardin Claude Code. - Claude walks them through the essentials, takes questions, and spot-checks understanding.
- Claude appends a row here and opens a PR; the merge is the completion record.
- Anything they flagged as unclear or not-matching-reality is noted and routed to the ISM as an improvement item.
Change log¶
| Version | Date | Author | Comments |
|---|---|---|---|
| 0.1 | 2026-07-02 | ISMS | Created — empty log, populated by /isms:onboard runs. |