Topics in this domain
- Enterprise Architecture and IT Risk
- Change Management Risk
- Assets, Configuration and Dependencies
- Incident and Problem Management Oversight
- Project Governance and IT Risk
- Governing the Secure SDLC
- DevOps, CI/CD and Agile Delivery Risk
- Testing, Release and Deployment Risk
- Data Classification, Ownership and Handling
- Data Lifecycle: Integrity, Retention and Disposal
- Business Continuity Planning and Governance
- Disaster Recovery and Testing Recovery Capability
- Emerging Technology Risk: Cloud, IoT and OT
- AI and Machine Learning Risk
- Setting Risk Boundaries for Innovation
- Core Security Concepts: CIA, IAM, Cryptography and Network Security
- Security Frameworks and Control Standards
- Security Awareness Culture and Measuring Training
- Privacy Governance and Data Protection Principles
- Developing a Data Protection Control Strategy
Security Awareness Culture and Measuring Training
Why awareness matters
Phishing, misdirected emails, weak passwords and approving fake payments are human actions. Technical controls help, but people who recognise and report risk are a control in their own right.
Building the program
Measuring what matters
Example. Training completion was 100% for two years, but the phishing click rate stayed at 25%. Shorter monthly simulations with instant feedback, plus a one-click report button, cut clicks to 6% and doubled reporting.
Targeting high-risk roles
- Finance: payment fraud and supplier impersonation.
- Administrators: privileged access and social engineering.
- Executives: whaling and confidentiality.
- Developers: secure coding.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST measure of awareness effectiveness | Behaviour change, such as fewer phishing clicks |
| Weakness of completion rates | They show activity, not effect |
| Group needing targeted training | High-risk roles such as finance and administrators |
| Improve incident reporting | A no-blame culture and simple reporting |
In short
- Many incidents start with human action; awareness reduces the likelihood of people-caused risk events.
- Effective programs are continuous, relevant, role-based and supported by leaders.
- High-risk roles such as finance, administrators and executives need targeted training.
- Measure behaviour (phishing click and report rates, user-caused incidents), not just completion.
- A no-blame reporting culture is as important as training content.
Exam traps
- Measuring success by training completion rates.
- One annual session for everyone.
- Punishing people who report mistakes.
- Ignoring executives and privileged users.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Building the program
Measuring what matters
ExampleTraining completion was 100% for two years, but the phishing click rate stayed at 25%. Shorter monthly simulations with instant feedback, plus a one-click report button, cut clicks to 6% and doubled reporting.
1 / 8