Security Training

Owner: Security. Review cadence: annual or on material change.

This document defines what security training MeterBox requires, when it runs, and how completion is recorded. The cadence commits referenced here are the same ones called out in the information security policy § 10. This doc is the curriculum + records detail behind that one-line commitment.

1 — Who + when

On-hire — every employee and contractor completes the on-hire module (§ 3) within 14 days of start. Production access is gated on completion: the InfoSec policy § 5 onboarding step does not grant least-privilege production grants until the on-hire training is logged.
Annual refresher — every employee and contractor completes the annual refresher (§ 4) once per fiscal year. Completion is logged in the personnel file; the Security lead reports the org-wide completion rate to the CEO at the end of each fiscal year.
Triggered refresher — anyone involved in a substantiated security incident, near-miss, or a Code of Conduct violation completes a targeted refresher within 30 days of the incident close.

2 — Curriculum overview

Both the on-hire and annual modules cover the same areas; the on-hire module is longer (≈ 90 minutes) because it includes orientation, and the annual refresher is shorter (≈ 30 minutes) because it focuses on what's changed and recent incidents.

Area	Why it's in the module
1. InfoSec policy walkthrough	Roles, classification, acceptable use, access control.
2. Phishing + social engineering recognition	The single highest-frequency external attack vector.
3. Acceptable use of AI / LLM tooling	Restricted data must never leave the cluster; Confidential data only goes to reviewed LLMs with no-training clauses.
4. Data classification + handling	The four-tier model (Public / Internal / Confidential / Restricted) from InfoSec § 3.
5. Incident reporting + the IR plan summary	What to report, where, and how the IR plan escalates from there.
6. Secret management basics	No plaintext secrets anywhere outside the cluster's secret store or the company password manager. Rotation cadence per operator runbook § 1.5.
7. Code of Conduct refresher	Expected behavior, reporting channel, anti-retaliation.

3 — On-hire module

Run by the Security lead (or a designate) in a 90-minute session, in person or video, within 14 days of the new hire's start date. Covers all seven areas in § 2 with examples specific to the new hire's role.

Required artifacts produced at the end of the session:

A signed acknowledgement that the new hire has read and understood the InfoSec policy and the Code of Conduct.
A short knowledge check (5 questions, drawn from areas 1–6 above). Failing the check pauses production-access grants; the new hire retakes it after a short remediation session.

4 — Annual refresher

Run by the Security lead in a 30-minute session each fiscal year. Format is async-friendly (recorded session + a short knowledge check) provided the recorded session is current within the fiscal year.

Each annual refresher highlights:

Changes to the InfoSec policy or Code of Conduct since the last refresher.
Notable incidents (anonymized) from the past year — what happened, what the IR plan caught or missed, what changed as a result.
The current quarter's risk register status — the top three risks the Security lead is most focused on.

5 — Completion records

Where — the personnel file (private; not in this repository). The Security lead maintains a roll-up index of who completed which module in which fiscal year.
What's recorded — name, role, module (on-hire / annual / triggered), date completed, knowledge-check score, acknowledgement signed.
Retention — for the duration of employment + 7 years after, per the data retention policy legal-obligation exception for HR records.

6 — Exceptions

Late completion — a one-time 30-day extension may be granted by the Security lead when there's a legitimate scheduling conflict (parental leave, medical leave). Recorded as a documented exception per the InfoSec policy § 12.
Material substitution — equivalent external training (e.g. a SANS course) may substitute for the annual refresher if it covers § 2 areas 1–6 and is current within the fiscal year. Substitution requires Security lead approval and the completion certificate is filed alongside the personnel record.

7 — Review + version control

This document is reviewed annually or on material change (new module area, regulator-driven curriculum requirement, structural change to the cadence).
Material changes go through PR review + Security lead approval + a CHANGELOG entry.

Last reviewed: 2026-06-04

Related docs

InfoSec policy § 10 — top-level training commitment.
Code of Conduct — § 7 in the curriculum.
Incident response plan — § 5 in the curriculum.
Risk register — drawn from for the annual refresher.
Data retention policy — HR records retention.