Stage02 02 Example SecurityAwarenessPolicy

Security Awareness and Training Policy
1. Overview
We recognize human risk as one of the top risks our organization faces. We define human risk
as including accidental threats (trusted individuals making simple mistakes), negligence (trusted
individuals deliberately not following policies), and deliberate threats (the malicious targeting of
our workforce by cyber attackers). In addition, leadership values not only secure behaviors but
ultimately establishing a strong security culture that contributes to the overall security and
mental health of our workforce.
2. Purpose
To effectively manage our human risk, our security team (in collaboration with other
departments) will provide continuous outreach, engagement, and security training to our
workforce throughout the year. The end goal is to ensure our workforce is actively exhibiting
expected secure behaviors to reduce our human risk to an acceptable level. In addition, we
intend to build a strong security culture that contributes to, enables, and encourages our
workforce to build security into their everyday actions and priorities.
3. Scope
This policy is applicable to all individuals (senior leadership, employees, and contractors) who
have an organization email address and/or access to organizational systems or information.
4. Training Policy
4.1 Annual Training
All employees are required to take and successfully complete security training, usually in the
form of online computer-based training (CBT) or instructor-led training (ILT), within the first 30
days of employment. They are then required to retake and complete the training on an annual
basis. All contractors or vendors with an organization email address or access to company data
are required to take the same training (or equivalent) before they can gain access to our data or
our systems and to continue to train on an annual basis if they are retained for longer than 1
year.
SANS LDR433 – https://sans.org/ldr433

4.2 Continuous Engagement and Reinforcement Training
In addition, we recognize that annual training alone is not enough to secure our workforce and
ultimately build a strong security culture. In addition to annual training, our security team will
actively provide security communications, engagement, and reinforcement training throughout
the year, to include the following:
 Monthly phishing simulations

 Cyber Threat Intelligence updates and reports
 An active online forum where our workforce can interact with and ask the security team
questions or learn more about security, expected behaviors, and/or our security policies.
 Additional training materials such as newsletters, infographics, micro videos, digital
signage, tip sheets, and podcasts
 Special events such as guest speakers or scavenger hunts
 Knowledge assessments and quizzes to test knowledge retention and comprehension.
 Periodic unscheduled awareness assessments to ensure compliance with the training.
 Feedback surveys to improve our security awareness training and education program.
Training completion and results are maintained in personnel files as part of the permanent
record. Certain passing requirements and/or additional training may be required for specific
personnel based on their work roles and/or risk profiles.
4.2 Role-Based Training

Certain high-risk roles, departments, or regions may require additional or specialized training.
For example, the Software Development team may be required to take additional secure
software development training (SecDevOps) or the IT staff may be required to take additional
privileged access or cloud-based training. Specialized role-based training can be mandated
based on risk to the organization.
4.3 Ownership and Responsibilities

The security team will dedicate at a minimum one full-time individual to the role of security
awareness and education. This individual will report directly to the CISO. This individual’s
responsibility is to identify, prioritize, and help manage our organization’s human risk through
outreach, engagement, and training of our workforce. This individual will be expected to actively
partner and work with members of the security team and other departments, including
communications, marketing, legal, privacy, and human resources. In addition, this individual will
assist the security team in all of their outbound communications and tool roll-out efforts and
assist in any communications to the workforce about new policies or behavior expectations.

4.4 Annual Program Updating
The awareness program and corresponding training will be actively reviewed and updated on an
annual basis, to include reviewing not only the human risks being addressed but the modalities
and methods used for engagement, communication, and training and the metrics framework
used to measure impact.
4.4 Training Records and Measurements

Training events, participation and completion, engagement of the workforce, and key behaviors
and the risks they manage will all be maintained and tracked for both compliance purposes and
to better manage the overall program. Expected metrics to be tracked include:
1. Compliance Metrics: These measure the training and engagement activities to include
workforce completion rates. These metrics are used primarily for compliance purposes.
2. Impact Metrics: These measure actual changes of the workforce, to include assessing
their knowledge, tracking their behaviors, and measuring their attitudes and beliefs about
cybersecurity. These metrics are key to tracking impact to risk.
3. Strategic Metrics: These metrics track overall reduction in risk, to include reduction in
incidents, attacker dwell time, policy violations and overall costs.
5. Enforcement
Any individual who fails to take the required training, who continually fails periodic assessments,
or consistently demonstrates a risk to the organization may be interviewed by the individual’s
supervisor or security team to help better understand why. Additional training or security
controls may be required. In rare or exceptional cases, the individual could be subject to
disciplinary action, up to and including termination of employment.
6. Definitions and Terms

None
8. Revision History
Date of Change Responsible Summary of Change
December 2023 Security Awareness Separated out from the Acceptable Use Policy
Team (AUP) and converted to new format.

Stage02 02 Example SecurityAwarenessPolicy

Uploaded by

Copyright:

Available Formats

Stage02 02 Example SecurityAwarenessPolicy

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Stage02 02 Example SecurityAwarenessPolicy

Uploaded by

Copyright:

Available Formats

Security Awareness and Training Policy

SANS LDR433 – https://sans.org/ldr433

 Monthly phishing simulations

4.2 Role-Based Training

4.3 Ownership and Responsibilities

SANS LDR433 – https://sans.org/ldr433

4.4 Training Records and Measurements

6. Definitions and Terms

Date of Change Responsible Summary of Change

SANS LDR433 – https://sans.org/ldr433

You might also like