Training & Awareness

1. Purpose This policy ensures that all MFC Safe personnel receive continuous training and awareness in key operational areas, including cybersecurity, regulatory compliance, and safe software development practices. The goal is to maintain a high standard of knowledge and operational security throughout the organization.

2. Scope Applies to all employees, contractors, and interns of MFC Safe who interact with the company’s systems, data, customers, or development environments.

3. Objectives

• Promote a security-conscious culture

• Ensure adherence to data privacy and compliance requirements

• Educate staff on secure coding, data handling, and industry standards

• Support regulatory and audit readiness

4. Policy Guidelines

4.1 Cybersecurity Awareness Training

• All employees must complete cybersecurity training within 30 days of onboarding.

• Training modules include phishing awareness, secure password practices, data protection, and remote work security.

• Annual refresher training is mandatory.

4.2 Compliance Training

• Employees involved in data processing, legal, product, and IT functions must receive training on GDPR, ISO 27001, and any local data regulations.

• Role-specific training is updated whenever regulatory standards evolve.

4.3 Secure Coding Training

• Developers must complete secure software development training, which includes OWASP Top 10 threats, input validation, and API security.

• Training is required annually and upon significant updates to the secure development lifecycle (SDLC).

4.4 Platform and Ecosystem Familiarization

• New hires are trained on MFC Safe’s technical architecture, including AWS, MongoDB, and Didge platform integrations.

• Training includes access control policies, incident reporting, and internal tooling.

5. Roles and Responsibilities

• HR & Compliance: Tracks completion and certification records

• IT & Security: Delivers training content and manages the LMS

• Line Managers: Ensure team participation and compliance

6. Monitoring and Audit

• Training participation and results will be audited quarterly.

• Non-compliance is escalated to department heads and subject to HR follow-up.

7. Exceptions Requests for exception from training requirements must be submitted in writing and approved by the Compliance Officer.

8. Enforcement Failure to comply with this policy may result in disciplinary action, up to and including termination.

9. Review and Updates This policy will be reviewed annually or upon major changes in regulatory or business requirements.

---

Document Version: 1.0 Owner: Compliance & Training Officer, MFC Safe Effective Date: 02 April 2025