9 - Criminal Background checks for all employees and contractors should be performed
Purpose:
Promotes safe workplace and helps meet contractual obligations
Best Practices:
Reputable background check provider
10 - Job-specific training that addresses the unique security challenges shall be done annually
Purpose:
Training helps reduce human errors and social engineering attacks
Best Practices:
Create a common minimum training first. Then develop for crucial roles.