Xoxoday Empuls updates its security awareness training program at least annually, incorporating the latest security policy changes, emerging threat intelligence, and current regulatory requirements, with mandatory rollout to all employees and relevant contractors as part of the yearly training cycle.
Annual Security Awareness Training Updates
Maintaining a current and effective security awareness training program is a core part of Xoxoday Empuls’s security posture. The training program is reviewed and updated at least once every year, ensuring all content remains aligned with the organisation’s evolving Security Policy and the broader threat environment. Each annual cycle covers three key dimensions: internal policy changes, such as updates to data handling procedures or access control standards; emerging threats, including new phishing techniques, social engineering tactics, and ransomware vectors identified throughout the year; and regulatory shifts, such as updated controls under ISO 27001 or SOC 2 Type II criteria relevant to employee behaviour and data stewardship.Mandatory Rollout to Employees and Contractors
Once updated content is finalised, Xoxoday Empuls rolls it out organisation-wide as part of the mandatory yearly training cycle. This applies to full-time employees and relevant contractors alike, ensuring that anyone with access to Xoxoday Empuls systems or data completes the refreshed modules before the cycle closes. Completion is tracked centrally, giving security and compliance teams a clear view of training status across the workforce. This supports audit readiness under SOC 2 Type II, where evidence of annual security training is a standard control requirement reviewed during external assessments.Why Annual Updates Matter
Threat landscapes shift quickly. A training programme that accurately reflected best practices 18 months ago may now omit guidance on current attack patterns — such as AI-assisted spear-phishing or credential-stuffing attacks targeting SaaS integrations. By committing to at least annual updates, Xoxoday Empuls ensures employees receive actionable, relevant guidance rather than outdated material. For organisations evaluating Xoxoday Empuls as part of a vendor risk assessment — a common step for HR and IT procurement teams using platforms like Workday, SAP SuccessFactors, or Darwinbox to manage vendor onboarding — this annual cadence demonstrates a structured, policy-driven approach to human-layer security controls.Alignment with Security Policy
The training update cycle is directly tied to the Security Policy review process. Any material change to Security Policy triggers a review of affected training modules, meaning updates can occur more frequently than once a year when warranted. The annual cycle sets a minimum floor, not a ceiling. This approach reflects industry best practice under ISO 27001 Annex A control A.7.2.2 (Information Security Awareness, Education and Training), which requires training content to be relevant, current, and reviewed on a regular basis. Xoxoday Empuls treats this not as a compliance checkbox but as a continuous investment in reducing human-layer risk across the organisation. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](Does Xoxoday Empuls review security policies annually?
Learn how Xoxoday Empuls conducts regular Security Policy reviews to keep controls current with evolving threats and compliance requirements.
Does Xoxoday Empuls have a formal IT risk management process?
Explore how Xoxoday Empuls approaches IT risk assessment, including risk identification, evaluation, and treatment across the platform.