Every employee needs security training within 30 days and annually. Can you run it and prove it?

Florida Statute 282.3185 requires basic cybersecurity training for all local government employees with access to the network, within 30 days of commencing employment and annually thereafter. Technology professionals and staff who handle sensitive information get advanced training on the same timeline. The Florida Digital Service develops curricula, and there are free state resources as well as commercial platforms.

What we run: assignment on hire and annually, automated reminders, chasing the people who ignore the reminders, and a completion report you can hand to your carrier or put in the evidence file. We also run periodic simulated phishing, which is where you find out whether the training took.

Three things worth flagging, because they are the ones that trip small governments up:

• Count everybody with network access. Part time and seasonal staff. Parks and public works employees who only touch a shared computer. Elected officials with a city email address. If they have access, they are in scope, and the elected officials are usually the ones nobody thought to include.
• Onboarding has to trigger it. Thirty days is easy to miss when hiring is handled by one person with six other jobs. We tie training assignment to account creation so it happens without anyone remembering.
• Keep the records past the current year. The question after an incident is whether the person who clicked the link had been trained, and that is a question about last year.

One candid note. Annual training that people click through does very little on its own. What actually moves the needle is short, frequent, and specific, plus simulated phishing with a no blame follow up, plus multi-factor authentication so that a click does not become a breach. The compliance requirement and the actual protection are related but they are not the same thing, and you want both.