Skip to main content

Security Awareness and Training

Security awareness and training is the human layer of an information security program. Controls, policies and technology fail when people do not recognize a threat, do not know the correct procedure, or are not motivated to follow it. This subcategory covers how to design, deliver, measure and improve an awareness program that changes behavior rather than just ticking a compliance box.

The material is written for security managers, awareness program owners, CISOs, and anyone responsible for the human side of security. It maps to CISSP Domain 7 (Security Operations) and Domain 1 (Security and Risk Management), CISM Domain 3 (Information Security Program Development and Management), and Security+ SY0-701 Domain 5 (Security Program Management and Oversight).

Format​

Process-based. Each file follows the 9-section skeleton:

  1. Overview
  2. Where in the Organization
  3. Threats and Failure Modes
  4. Controls and Implementation
  5. Tooling
  6. Verification and Metrics
  7. Anti-Patterns
  8. Certification Alignment
  9. References

Files​

#FileFormat
01Awareness Program Fundamentalsprocess-based
02Training Design and Deliveryprocess-based
03Phishing Simulation and Metricsprocess-based
04Security Culture and Behaviorprocess-based
05Measuring Awareness Effectivenessprocess-based

References​