A licensee must evaluate improvement in the level of awareness and preparedness to deal with cyber security risk to ensure the effectiveness of training programmes implemented.