Employee Training and Awareness Policy
Most security incidents start with a person being tricked, not a system being broken. Training everyone well, and often, is one of the cheapest and most effective protections we have. This policy sets out what training everyone completes, and when.
Document
Policy number
TSS-IT-14
Version
1.0
Effective from
1 September 2026
Next review
March 2027
Owner
Human Resource Team, with the IT Team
Approved by
Board of Directors
Applies to
Every employee, including trainees during induction, and every intern, including interns under 18. Contractors where their contract says so.
Issued by
Thakur Systems & Structures Private Limited, CIN U62011PN2026PTC254650
Related policies
Information Security Policy (TSS-IT-02), Anti-Harassment and Non-Discrimination Policy (TSS-HR-02), Software Development and Change Management Policy (TSS-IT-10), Health and Safety Policy (TSS-HR-08), Expense Reimbursement Policy (TSS-HR-07)
1. THE TRAINING PLAN
| TRAINING | WHO | WHEN |
|---|---|---|
| Induction: company policies, security basics, acceptable use, data privacy, anti-harassment and POSH awareness, our tools, and the rules for AI tools | Everyone | During induction, before any client work |
| Security refresher: phishing, passwords and MFA, social engineering, safe remote work, reporting incidents | Everyone | Every year, plus short monthly tips |
| Phishing simulations | Everyone | At least once every three months |
| TRAINING | WHO | WHEN |
|---|---|---|
| Secure coding: the OWASP Top 10, handling secrets, dependency safety | Developers | Within the first three months, then every year |
| AI tools: using them safely and well, the data rules, reviewing AI output | Everyone who uses them | During induction, and whenever the tools or rules change |
| Data privacy: DPDP Act basics and handling personal data | Everyone, with more detail for the HR team and anyone handling client personal data | Every year |
| Anti-harassment and POSH awareness | Everyone | Every year |
| Incident response roles | The IT team and the Directors | Every year, with the practice exercise |
| Client-specific training | People working on that client’s projects | As the client requires |
| Health and safety: fire exits, first aid, ergonomics | Everyone | During induction, plus a fire drill every year |
| Working with interns under 18: the safeguarding rules in the Internship Policy | Everyone who supervises or works closely with an intern under 18 | Before the internship starts |
2. COMPLETING TRAINING
Complete required training within the time given, normally within 14 days of it being assigned.
Training is done during working hours. It is work, not homework.
The HR team keeps a record of the training everyone has completed.
If required training is overdue, access to client systems or Restricted data may be paused until it is done.
3. PHISHING SIMULATIONS
We send realistic but harmless test emails and messages to see how well we spot them as a company.
If you spot one, report it the normal way. You will get a thank-you.
If you click, you will see a short explanation of what to look out for next time. That is the only consequence. Repeated clicks lead to a one-to-one refresher, not punishment.
The Directors see results as team-level numbers. Individual results are seen only by the IT team, and are used to help people, not to rank them.
Simulations will never use content designed to upset people, such as fake salary cuts, bonuses, layoffs, health scares or family emergencies.
4. STAYING ALERT DAY TO DAY
The IT team shares short updates about current scams and threats.
You can ask the IT team whether a message, link or request looks genuine. Asking is always better than guessing.
When you report something suspicious, the IT team will tell you what it turned out to be.
5. LEARNING AND GROWING
Beyond the required training, we encourage everyone to keep learning, especially in AI-assisted development and the technologies used in their role. Courses and certifications related to your role can be paid for under the Expense Reimbursement Policy, with approval in advance.
6. WHO DOES WHAT
The HR team schedules training, keeps records, and follows up on overdue training.
The IT team prepares the security content, runs phishing simulations, and reports the results.
Team leads make time for their teams to complete training.
Everyone completes training on time and puts it into practice.