Do employees receive training in basic cyberhygiene practices?

Cyberhygiene and training: two separate measures

Yes, this field is standard in information security questionnaires, as it is one of the ten measures in Article 21(2) of the NIS2 Directive. Point (g) of that paragraph specifically states "basic practices in the field of cyberhygiene and cybersecurity training". So it concerns two things at once: structural basic practices (password policy, update discipline, safe handling of attachments and links) and training that alerts employees to them. A customer asking this usually wants to know whether there is something in place alongside technical measures — the human element of security.

As evidence, customers typically request a training overview, an e-learning module with completion percentage, or an internal policy document containing the basic practices. If you do not have that, then "no" or "not yet in place" is a more honest answer than suggesting a training that does not exist — the customer often asks this specifically as a supplement to questions about access policy, so also check whether the organization's access policy has been documented, as awareness without underlying policy rarely convinces. Also pay attention to frequency: a one-time training at induction is different from annual repetition, and that distinction often makes a difference in the customer's assessment.

Where this comes from: Article 21(2), point (g)

Article 21(2) of Directive (EU) 2022/2555 lists ten categories of measures that entities must take to secure their networks and information systems. Point (g) specifically mentions cyberhygiene and security training, alongside, among others, point (a) on risk analysis policy — see also how risk analysis policy is assessed — and point (d) on business continuity. This question therefore cannot be viewed in isolation: it is one of the ten mandatory elements that a customer systematically reviews.