What should training and awareness for account management cover?

• A. One-time onboarding training is enough.
• B. Regular training on policies, phishing awareness, password hygiene, MFA usage, and incident response.
• C. Training should focus only on password changes.
• D. Training is unnecessary if IT provides automation.

Answer: (B)

Regular, ongoing training and awareness are essential for account management because security isn’t a one-and-done task. People need to know the applicable policies, how to recognize phishing and social engineering, how to maintain strong credentials and avoid reuse, how to enable and use multi-factor authentication, and what to do when something suspicious or a potential incident occurs. This combination builds good habits, keeps everyone up to date as threats evolve, and reduces the chance that an attacker exploits human factors. One-time onboarding misses the ongoing need to reinforce safe practices; focusing only on password changes overlooks phishing, MFA, and incident response, which limits effectiveness. Automation helps protect systems, but without informed users who understand policies and proper response, gaps remain.