The company formally conducts simulated phishing exercises to test and improve employee resilience
This policy control mandates recurring phishing simulations with defined frequency and scope, a specific awareness exercise A.6.3 expects as part of ongoing training.
This policy facet mandates recurring simulated phishing exercises with defined frequency and scope, the awareness half of A.8.7's protection, pairing technical controls with user readiness.