All employees, who work within the scope of ISO requirements relevant to information security, shall be required to attend additional training once a year in classroom courses or via video conference on the subject of information security management.