Requirement:

The asset owner shall have policies and procedures requiring all personnel (including employees, contractors, subcontractors, consultants, product suppliers and service providers) who interact with the IACS receive formal cybersecurity training that is relevant to their IACS cybersecurity responsibilities. Such training shall either be accepted or provided by the asset owner.

Guidance: