Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Role-Based Security Training
One size doesn’t fit all
A receptionist, a payroll clerk, a database administrator and the CEO face very different threats and hold very different powers. Role-based training puts the most effort where a mistake would do the most damage.
Training by role
| Role | Main risks | Training focus |
|---|---|---|
| All staff | Phishing, passwords, data handling | Basics, reporting, acceptable use |
| Executives and board | Targeted attacks, deepfakes, decisions | Whaling, risk oversight, crisis roles |
| Finance and procurement | Payment fraud, invoice scams | Business email compromise, call-back verification |
| IT and administrators | Privileged misuse, misconfiguration | Secure administration, PAM, change control |
| Developers | Insecure code, secrets in code | Secure coding, OWASP, threat modelling |
| HR and customer service | Personal data, social engineering | Privacy, identity verification |
Training needs come from risk assessments, incidents, audits and role changes. People who move roles get the new role’s training.
Executives and the board
Executives are often exempted from training, yet they’re prime targets. Cover:
- how they’re targeted: whaling, deepfakes and impersonation
- their governance duties: risk appetite, oversight and approvals
- their role in a crisis: decisions, communications and regulators
- short, scenario-based sessions and tabletop exercises
Example. In a 45-minute tabletop, the executive team rehearses a ransomware attack: who decides on shutting systems down, who talks to regulators, whether to pay. Two gaps appear: no one knew the cyber insurer had to be called first, and there was no deputy for the CEO during travel.
Developing the security team
The security team itself needs ongoing development to keep pace with threats:
- technical skills: cloud, detection, incident response, AI security
- certifications: CISM, CISSP, cloud and vendor certifications
- exercises: incident simulations, capture-the-flag events, red-team debriefs
- business skills for senior staff: communication, risk, finance
This belongs in the program budget, not as a perk.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Why use role-based training? | It addresses role-specific risks and privileges |
| Training for finance staff | Payment fraud and business email compromise |
| Training for developers | Secure coding |
| Executives want to skip training | Senior management must take part; they’re targets |
| Source of training needs | Risk assessments, incidents, audits and role changes |
In short
- Everyone needs basic awareness; roles with more privilege or exposure need targeted training.
- High-risk roles include executives (targeted attacks), finance (payment fraud), IT administrators (privileged access), developers (secure code) and staff handling personal data.
- Executives and board members need training on their oversight duties and crisis roles, as well as on being targets.
- The security team itself needs ongoing technical training and certifications to keep pace with threats.
- Training needs come from risk assessments, incidents, audits and role changes.
- Completion and effectiveness are tracked per role; people moving roles get the new role's training.
Exam traps
- One generic course for everyone misses the biggest role-specific risks.
- Executives are often exempted from training but are prime targets.
- Developers without secure coding training repeat the same vulnerabilities.
- Training the security team is part of the program budget, not a perk.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Training by role
1 / 8