Security awareness training (draft)

Sign-off: approved by [Kyle] on [date], second reader [Dan] on [date]; recorded in approvals.md. Review yearly.

Lucent Axis, SCOPE. Version 1, 28 Oct 2026, for ORG-14 (CC1.4, CC2.2). Owner: Kyle. Everyone with access to SCOPE's systems reads this on joining and every year, then signs the record at the foot together with the information security policy. About 20 minutes. Free first: our own material in place of a paid course; the compliance platform's course replaces it if one is chosen (ORG-04).

1. What we protect, and why it matters

SCOPE holds other people's health and identity information: injuries, DOT medical cards, licences, investigation findings, where a driver was. A leak harms a named person, not just us, and ends the client's trust. Treat every record as if it were about you.

2. Your accounts

MFA on every company account, with an authenticator app or a security key, not text messages where there is a choice.
A unique password for each, kept in the company vault. Never reuse a personal password.
Never share an account or approve an MFA prompt you did not start. An unexpected prompt means someone has your password: deny it and tell the security owner.

3. Phishing and pretexting

Check the sender's real address and the link's real destination before you click.
Nobody at Lucent Axis, GitHub, Vercel or Supabase will ask for your password, an MFA code or a database URL by email, chat or phone.
Urgency ("the demo is in ten minutes, send me the key") is the classic sign. Slow down, and confirm through a second channel you already know.

4. Handling client data

Client data stays in the client's SCOPE project. No copies on your laptop, in email, in chat, in screenshots, or pasted into an AI tool.
The demo and development databases hold synthetic data only. Never load real data into them.
Secrets (keys, the database URL, passwords) go in the vault and .env.local, never in code, a ticket, a document or a chat message. gitleaks blocks most of them; do not rely on it.

5. Your laptop

Disk encryption, a screen lock of five minutes or less, automatic OS updates, the built-in malware protection on, and a lock screen when you step away (BYOD policy). A lost or stolen laptop is reported at once, and within 1 hour of noticing.

6. Reporting

Report anything that looks wrong to the security owner at once, and within 1 hour of noticing: a strange login, a file in the wrong place, a mistake of your own. Reporting in good faith is never punished; hiding it is the only thing that makes it worse. The incident response plan takes it from there.

Record

Name	Role	Version read	Date	Signature