Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Security Awareness Program Design
People as a control
Many incidents start with a person: clicking a link, sharing a password, sending a file to the wrong address. But people also spot and report attacks no tool would catch. A good awareness program turns the workforce from the weakest link into an early-warning network. One CISM task is to establish, promote and maintain a program for information security awareness and training.
The program cycle
- Assess needs: which behaviours cause incidents, which can stop them, which audiences matter, and what the culture is like.
- Set objectives: behavioural and measurable, such as “raise the phishing report rate to 70%”.
- Design content: relevant, short, varied and tailored to roles.
- Deliver: onboarding before access, refreshers, campaigns, simulations.
- Measure outcomes.
- Improve, adjusting to results and new threats.
Delivery through the year
Once a year isn’t enough. Short, frequent and relevant beats long and annual: onboarding on day one, a yearly refresher, role-based training, and reinforcement all year through simulations, short messages and briefings after incidents.
Measure behaviour, not attendance
| Activity measure (weak) | Behaviour measure (strong) |
|---|---|
| Training completion rate | Phishing simulation report rate |
| Hours of training delivered | Click-rate trend on simulations |
| Posters displayed | Incidents caused by user error |
| Quiz pass rate | Time from a phishing email to its first report |
What makes it work
- Leaders take part: executives complete the same training and talk about it.
- No-blame reporting: thank people who report, even if they clicked first. Shaming people drives problems underground.
- Relevant stories: real incidents from the organisation and its sector.
- Easy reporting: one button in the email client.
Example. A company replaces its annual one-hour video with five-minute monthly modules, a phishing-report button and quarterly simulations. Within a year, the report rate rises from 12% to 64%, and the first report of a real phishing wave arrives within four minutes.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Best measure of awareness effectiveness | Behaviour change, e.g. reporting rate and fewer incidents |
| First step in designing an awareness program | Assess the human risks and the audiences |
| When should new staff be trained? | At onboarding, before they get access |
| Most important success factor | Senior management support and participation |
| Staff who report their own mistakes | Encourage them: a no-blame culture |
In short
- Establishing, promoting and maintaining an awareness and training program is a CISM task; people are both a major risk and a strong control.
- Design starts from the human risks: which behaviours cause incidents, and which behaviours can stop them.
- Objectives are behavioural and measurable, such as 'raise phishing report rate to 70%'.
- Content is relevant, short, frequent, varied and tailored to audiences; onboarding before access, then regular reinforcement.
- Measure behaviour (reporting, click rates, incidents, policy exceptions), not completion rates alone.
- Senior management participation and a no-blame reporting culture make awareness work.
Exam traps
- Annual compliance training alone rarely changes behaviour.
- 100% completion says nothing about effectiveness.
- Generic content ignores the risks of specific roles.
- Shaming people who click discourages reporting, which is the behaviour you want most.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The program cycle
Delivery through the year
1 / 9