Safety & Compliance

DEOS Security Awareness Training And Education

Company: I REVLAB, INC.
Program Owner: DEOS Security, supported by Management, Engineering, Operations, and Legal
Document Version: 2.0
Last Updated: November 4, 2026
Review Cycle: At least annually and following material changes in threats, systems, or requirements

DEOS security awareness training prepares personnel to recognize threats, protect dealership and Company information, use technology responsibly, and report concerns promptly. The program combines onboarding, annual refresher training, role-specific education, practical exercises, and targeted updates throughout the year. It addresses the human decisions involved in operating an AI engagement platform, including access to dealership systems, customer communications, sensitive data, and automated agents. Training reinforces technical safeguards and accountable operating procedures; it does not replace them.

Purpose And Scope

This policy establishes mandatory security and privacy learning requirements for DEOS employees, including management, and for contractors and other authorized personnel according to their responsibilities and access. Service providers must ensure that personnel accessing DEOS systems or protected information receive appropriate training under the applicable security and contractual requirements. Equivalent provider training may be accepted following documented review; access does not remove the need for DEOS-specific instructions.

The program supports the DEOS Trust Management System and SOC 2 Type 1 readiness activities. Its design draws on NIST SP 800-50 Rev. 1 as a learning-program reference and addresses relevant training and service-provider oversight obligations under the FTC Safeguards Rule, according to DEOS's role and applicable commitments. Framework references do not represent a separate certification.

Table Of Contents

01. Governance And Accountability

Security coordinates the curriculum, exercises, learning records, and evaluation of results. Management ensures that personnel receive the time and resources necessary to meet requirements. Engineering, Operations, and Legal contribute technical, operational, privacy, and regulatory content relevant to their functions.

Managers track completion for their teams, address overdue assignments, and ensure that changes in responsibilities trigger appropriate additional training. Each covered individual must complete assigned learning, follow approved procedures, protect credentials and information, and report suspected incidents or weaknesses.

Training requirements apply to senior personnel and privileged users as well as other staff. Technical experience, job title, or completion of general industry training does not automatically exempt an individual from DEOS-specific requirements.

02. Required Training And Timing

Training Stage Requirement
Onboarding Complete mandatory security and privacy training as part of onboarding, with the instructions needed for a role delivered before independent access to production systems or protected dealership information.
Annual Refresher All employees complete formal refresher training at least annually. Other covered personnel complete the requirements assigned according to their access and responsibilities.
Throughout The Year Complete targeted training when emerging threats, incidents, policy changes, or identified weaknesses require additional instruction.
New Or Changed Responsibilities Complete relevant education before independently performing newly assigned privileged, development, support, data-handling, or incident-response duties.
Remediation Complete focused follow-up training when assessments, exercises, or actual events identify a knowledge or behavior gap.

Assignments include a defined audience, due date, and required evidence of completion. Urgent security instructions may be issued immediately rather than waiting for the next scheduled course. Managers and Security coordinate any supervised onboarding activities needed before all training is complete; such activities do not authorize unrestricted access.

03. Core Security And Privacy Curriculum

The core curriculum covers the following subjects in language appropriate to the audience:

Training explains how to apply these requirements to ordinary work. Examples address mistaken recipients, fraudulent reset requests, exposed credentials, suspicious attachments, and unexpected access to information belonging to another dealership.

04. Dealership Data And AI Responsibilities

Personnel must understand that access to dealership data is purpose-limited and tenant-specific. A support role, dealer-group relationship, agency engagement, or OEM affiliation does not automatically authorize access to every store or database. Staff must verify the requesting party, dealership context, permissions, and business purpose before retrieving, exporting, or changing information.

Training covers DMS, CRM, scheduling, communications, and Dealer Data Universe (DDU) records, including the risks created by screenshots, logs, support tickets, downloaded files, and test data. Personnel must use approved support and testing methods and avoid copying unnecessary personal information into collaboration tools or training examples.

Private customer records, prompts, conversations, biometric information, and likeness assets must not be entered into unauthorized external AI services or used to train shared or general-purpose models for unrelated customers. Approval of an AI tool for one purpose does not authorize every category of data or use. Authorized cloud processing remains subject to DEOS's approved architecture, data boundaries, and agreements.

Personnel working with AI learn to recognize prompt injection, attempts to obtain another tenant's information, unreliable model outputs, unauthorized tool calls, and changes to agent authority. Retrieved content and AI-generated instructions are not independent authorization to access records, execute a transaction, or bypass a control.

Training also reinforces consent, suppression, approved content, human escalation, and likeness permissions for customer engagement. Staff must not disable communication safeguards or assume that a customer's business instruction overrides a legal requirement or an individual's rights.

05. Role-Specific Education

Additional education addresses the duties and risks of particular functions:

Role-specific education supplements the core curriculum. Personnel responsible for security and emerging technologies receive continuing instruction appropriate to their responsibilities and the changing threat environment.

06. Practical Exercises And Phishing Simulations

DEOS uses interactive modules, realistic scenarios, and recurring phishing simulations to reinforce expected behavior. Exercise frequency and audience are selected according to risk, results, and relevant threat developments. Targeted exercises may address executive impersonation, fraudulent dealership requests, credential theft, or unauthorized AI data handling.

Exercises are authorized and controlled. Simulations must not request or retain real passwords, expose protected dealership information, deliver destructive content, or send unauthorized messages to consumers. Scenario data should be synthetic or otherwise approved for that use.

Immediate feedback and short follow-up lessons help personnel understand the warning signs and correct response. Gamification may support engagement where appropriate, but course participation or a high score alone does not demonstrate operational competence.

Results inform training improvements and proportionate follow-up. Exercises are designed to strengthen reporting and learning rather than discourage personnel from admitting mistakes or raising concerns.

07. Incident Recognition And Reporting

Personnel must promptly report suspected phishing, account compromise, lost devices, unintended disclosures, exposed credentials, suspicious AI behavior, and possible cross-dealership access. A person does not need to prove that a breach occurred before reporting.

Reports follow the approved internal security or incident channel. If the normal channel is unavailable, personnel use the designated alternate route, including support@deos1.com where appropriate. Sensitive details and evidence must be shared through approved secure methods rather than broadly distributed.

Personnel should stop the affected activity and follow authorized containment instructions. They must not independently investigate beyond their authority, delete evidence, forward malicious content to colleagues, or contact a suspected attacker. If credentials were entered or an action was mistakenly approved, the report must include that fact promptly.

Security coordinates investigation and response. Management, Legal, and designated communications personnel control external incident statements and required notices. Training emphasizes that timely, good-faith reporting is expected and supported.

08. Completion Records And Effectiveness

DEOS maintains records of assignments, course or material versions, completion dates, acknowledgments, relevant assessment results, and remediation. Provider training evidence is retained according to the oversight arrangements applicable to that relationship.

Records are protected according to their sensitivity and retained under the applicable records schedule and legal hold requirements. Individual results are shared only with personnel who need them for program administration, supervision, assurance, or remediation.

Program evaluation considers completion and overdue rates, demonstrated understanding, reporting behavior, repeat weaknesses, exercise results, and lessons from actual incidents. Simulations are interpreted in context; a single click rate or test score does not establish the effectiveness of the whole security program.

Material gaps and corrective actions are reported through the DEOS Trust Management System. Relevant evidence supports internal review, customer diligence, and independent examination within the applicable scope.

09. Remediation, Exceptions, And Access Consequences

Personnel who do not demonstrate required understanding receive targeted instruction and reassessment as appropriate. Repeated issues trigger a review of workflow design, supervision, access permissions, and technical safeguards as well as individual training.

Overdue mandatory training is escalated to the responsible manager and Security. Access may be withheld, restricted, or suspended according to the risk and applicable personnel or provider procedures. Deliberate circumvention or misuse may result in further action under the relevant policies and agreements.

Any temporary exception requires documented justification, an accountable owner, authorized approval, compensating controls, and a deadline for completion or review. An exception cannot authorize unlawful conduct, remove a contractual protection, or permit unrestricted access merely because training is inconvenient. General reminders do not replace required training.

Security reviews the program at least annually and when material incidents, exercise findings, new systems, or changed requirements warrant earlier updates. Reviews assess curriculum relevance, role coverage, completion, practical effectiveness, provider arrangements, and corrective-action progress.

Training materials are updated through appropriate review and version control. Content must be understandable and accessible to the intended audience. Alternative delivery methods may be used when needed while preserving the learning objectives and evidence requirements.

This program operates alongside the DEOS Security And Technology Policies, Trust Management System, IT Change Management System, AI Governance Policy, Dealership Data Safeguards, TCPA Compliance And Acceptable Use Policy, Privacy Policy, and applicable personnel and service-provider requirements. Public customer guidance does not replace the mandatory workforce training described here.

11. Information Security Policies Notice

This document summarizes the DEOS security policy framework and communicates requirements for the personnel and providers within its scope. It does not, by publication alone, amend a customer agreement, create a separate service-level commitment, or change contractual remedies. Security or processing obligations expressly incorporated into an Agreement remain enforceable according to that Agreement.

DEOS reviews and updates its policies to reflect operational requirements, risks, technology, and law. Material changes follow applicable governance, contractual notice, and acceptance requirements. A policy revision does not retroactively authorize prohibited processing or reduce a nonwaivable right or duty.

Security controls are designed to manage risk and protect information; they do not guarantee that every incident or vulnerability will be prevented. This notice does not exclude responsibility for Company's own breach, negligence, unlawful conduct, or other liability contrary to law or the applicable Agreement. Customers and users remain responsible for the security duties assigned to them under their agreements.

Security, privacy, governance, and diligence inquiries: legal@deos1.com
Operational support and suspected account compromise: support@deos1.com

I REVLAB, INC.
4910 Communications Ave, Suite 120
Boca Raton, FL 33431