To obtain and maintain AEO Security (AEOS) certification, staff training is a fundamental requirement. Even the best technical and physical measures are ineffective if employees are not prepared to recognize and counter threats such as phishing, social engineering, and unauthorized access. Customs authorities consider the human factor the weakest link in the supply chain: for this reason, continuous awareness is a pillar of the certification.

Regulatory requirements for AEOS training

Article 39, point (e) of the Union Customs Code (UCC) establishes that economic operators must ensure appropriate security standards. Among these is the obligation to ensure that personnel with relevant responsibilities regularly participate in security awareness programs. This is not a one-time fulfillment, but a continuous process aimed at:

• Instructing employees on corporate security policies
• Developing the ability to recognize threats and anomalies
• Defining clear procedures for incident reporting

Staff training integrates with other requirements of AEO certification in the cybersecurity field, helping to create a comprehensive and resilient security system.

Essential training content

Awareness programs must cover various operational areas to ensure complete supply chain protection:

• Identification of suspicious cargo: personnel involved in cargo handling must be able to detect anomalies in shipments and freight
• Recognition of internal and external threats: the ability to identify attempts at physical intrusion, system tampering, or unauthorized access
• Protection against cyberattacks: awareness of social engineering techniques and the ability to recognize phishing attempts
• Reporting procedures: knowledge of internal channels to immediately report suspicious cases or security breaches

Verifying effectiveness: simulations and practical tests

The regulations do not impose specific tests, but they do require that training provides concrete tools to recognize deviations from security policies. To prevent training from remaining a purely bureaucratic exercise, it is essential to measure its operational effectiveness through:

• Phishing simulations: controlled campaigns to evaluate the staff’s ability to recognize fraudulent emails and messages
• Social engineering tests: practical checks that measure resistance to psychological manipulation attempts
• Incident response drills: simulations that test readiness in following reporting procedures

ISGroup supports companies with simulated phishing and smishing campaigns and customized training paths to raise the level of staff awareness and reduce the risk of compromises that could jeopardize AEO authorization.

Documentation and continuous updating

The economic operator must maintain adequate records of awareness programs, including:

• Applied methodologies and training content
• List of participants and dates of completion
• Results of any tests and simulations

Training must be updated periodically to reflect the evolution of threats, changes in company procedures, and the arrival of new personnel. There is no mandatory fixed frequency, but best practices suggest annual update sessions and mandatory training for all new hires. These documentary aspects fall within the broader framework of security governance for AEOS.

FAQ – Cyber Training for AEO Certification

• Is security training mandatory to obtain AEOS?
• Yes. It is an explicit requirement of Article 39 of the UCC. Personnel with relevant responsibilities must regularly participate in security awareness programs.
• What documents must I keep regarding training?
• You must record the methodologies applied, training content, list of participants, dates of completion, and the results of any tests. This documentation is used to demonstrate compliance to customs authorities.
• How often should training be repeated?
• There is no mandatory fixed frequency, but training must be updated periodically based on changes in personnel, procedures, or threats. It is mandatory for all new employees.
• What topics should the training cover?
• Identification of suspicious cargo, recognition of internal and external threats, protection against phishing and social engineering, incident reporting procedures, and access controls.
• Are phishing simulations necessary?
• They are not legally mandatory, but they are highly recommended. They allow for the verification of training effectiveness and the staff’s real ability to recognize cyberattacks, reducing the risk of breaches.

Related insights

• AEO Audit and Vulnerability Assessment: how to prepare
• Vulnerability management for AEOS certification
• Network Penetration Test for AEOS: requirements and methodologies
• SOC Monitoring and Incident Response for AEOS
• AEOS and business partner security
• System and application security for AEOS