Skip to main content
deleted 1 character in body
Source Link
schroeder
  • 131.2k
  • 55
  • 306
  • 346

Security Awareness expert here (awards, best-selling book).

Absolutely, you should/need to customise training to the role/risks.

Many international bodies actually call this out as important:

Those wherewere just what I could recall off the top of my head.

But your questions at the end seem to show a misunderstanding about how the materials would be created.

Set a baseline standard

Your organisation needs to set a minimum standard for awareness that meets the risk profile of your organisation. That means that everyone gets the same basic foundations. On top of that is the role-specific material.

Same material, role-specific examples

But it can go deeper than that to be more effective. I advocate creating material that is role-specific using the same base material, but having the examples be role-specific. Don't show an HR example to the Shipping department. Keep the examples specific to the role, where practical, but cover the same material so that the foundations are the same. This helps to show why the material is important to the employee.

Train to meet the risks

In addition, different roles in your organisation are going to experience different risks, and those unique risks should be addressed in training. Finance and HR experience different risks and need different tools/procedures to meet those risks. The Shipping department is going to have a completely different set of risks. Training should most definitely be customised to the risks.

Yes, that is going to look daunting to anyone who is not a dedicated security awareness curriculum designer. That is a lot of work. And that's why most organisations do not do it. But they should.

Easy mode: Champions

One way to make it easier is to employ a "Champions" programme where selected individuals in each department/risk area are trained and supported to help design, deliver and be a point of contact for the department/risk-specific material. This has been shown to be extremely effective in many organisations. You should then take the custom material that has been shown to work and roll that into your learning program to make it more consistent and repeatable.

Next step: not just role-specific but audience-specific

In addition, I also advocate having different material for the different technological and demographic groups in your organisation. "How to spot a phish" training needs to look different for people who have never heard of the concept before than for IT experts. And the language and concepts used need to be understood by the various demographic groups in your organisation. For example, ask different people whether they know what a "browser" is. You might be shocked to see who has not heard of the term. That means your "How to spot a phish" material needs to either not use the term or train people on it.

Graduated materials

In my materials, I graduate them so that there is a rising skill and knowledge level. People unlock the higher levels when they have shown to be proficient in the lower levels. This means that the IT experts only have to deal with the basic material once, but are challenged by the brand-new techniques in the high levels. New people can grow with the material.

Security Awareness expert here (awards, best-selling book).

Absolutely, you should/need to customise training to the role/risks.

Many international bodies actually call this out as important:

Those where just what I could recall off the top of my head.

But your questions at the end seem to show a misunderstanding about how the materials would be created.

Set a baseline standard

Your organisation needs to set a minimum standard for awareness that meets the risk profile of your organisation. That means that everyone gets the same basic foundations. On top of that is the role-specific material.

Same material, role-specific examples

But it can go deeper than that to be more effective. I advocate creating material that is role-specific using the same base material, but having the examples be role-specific. Don't show an HR example to the Shipping department. Keep the examples specific to the role, where practical, but cover the same material so that the foundations are the same. This helps to show why the material is important to the employee.

Train to meet the risks

In addition, different roles in your organisation are going to experience different risks, and those unique risks should be addressed in training. Finance and HR experience different risks and need different tools/procedures to meet those risks. The Shipping department is going to have a completely different set of risks. Training should most definitely be customised to the risks.

Yes, that is going to look daunting to anyone who is not a dedicated security awareness curriculum designer. That is a lot of work. And that's why most organisations do not do it. But they should.

Easy mode: Champions

One way to make it easier is to employ a "Champions" programme where selected individuals in each department/risk area are trained and supported to help design, deliver and be a point of contact for the department/risk-specific material. This has been shown to be extremely effective in many organisations. You should then take the custom material that has been shown to work and roll that into your learning program to make it more consistent and repeatable.

Next step: not just role-specific but audience-specific

In addition, I also advocate having different material for the different technological and demographic groups in your organisation. "How to spot a phish" training needs to look different for people who have never heard of the concept before than for IT experts. And the language and concepts used need to be understood by the various demographic groups in your organisation. For example, ask different people whether they know what a "browser" is. You might be shocked to see who has not heard of the term. That means your "How to spot a phish" material needs to either not use the term or train people on it.

Graduated materials

In my materials, I graduate them so that there is a rising skill and knowledge level. People unlock the higher levels when they have shown to be proficient in the lower levels. This means that the IT experts only have to deal with the basic material once, but are challenged by the brand-new techniques in the high levels. New people can grow with the material.

Security Awareness expert here (awards, best-selling book).

Absolutely, you should/need to customise training to the role/risks.

Many international bodies actually call this out as important:

Those were just what I could recall off the top of my head.

But your questions at the end seem to show a misunderstanding about how the materials would be created.

Set a baseline standard

Your organisation needs to set a minimum standard for awareness that meets the risk profile of your organisation. That means that everyone gets the same basic foundations. On top of that is the role-specific material.

Same material, role-specific examples

But it can go deeper than that to be more effective. I advocate creating material that is role-specific using the same base material, but having the examples be role-specific. Don't show an HR example to the Shipping department. Keep the examples specific to the role, where practical, but cover the same material so that the foundations are the same. This helps to show why the material is important to the employee.

Train to meet the risks

In addition, different roles in your organisation are going to experience different risks, and those unique risks should be addressed in training. Finance and HR experience different risks and need different tools/procedures to meet those risks. The Shipping department is going to have a completely different set of risks. Training should most definitely be customised to the risks.

Yes, that is going to look daunting to anyone who is not a dedicated security awareness curriculum designer. That is a lot of work. And that's why most organisations do not do it. But they should.

Easy mode: Champions

One way to make it easier is to employ a "Champions" programme where selected individuals in each department/risk area are trained and supported to help design, deliver and be a point of contact for the department/risk-specific material. This has been shown to be extremely effective in many organisations. You should then take the custom material that has been shown to work and roll that into your learning program to make it more consistent and repeatable.

Next step: not just role-specific but audience-specific

In addition, I also advocate having different material for the different technological and demographic groups in your organisation. "How to spot a phish" training needs to look different for people who have never heard of the concept before than for IT experts. And the language and concepts used need to be understood by the various demographic groups in your organisation. For example, ask different people whether they know what a "browser" is. You might be shocked to see who has not heard of the term. That means your "How to spot a phish" material needs to either not use the term or train people on it.

Graduated materials

In my materials, I graduate them so that there is a rising skill and knowledge level. People unlock the higher levels when they have shown to be proficient in the lower levels. This means that the IT experts only have to deal with the basic material once, but are challenged by the brand-new techniques in the high levels. New people can grow with the material.

deleted 1 character in body
Source Link
schroeder
  • 131.2k
  • 55
  • 306
  • 346

Security Awareness expert here (awards, best-selling book).

Absolutely, you should/need to customise training to the role/risks.

Many international bodies actually call this out as important:

Those where just what I could recall off the top of my head.

But your questions at the end seem to show a misunderstanding about how the materials would be created.

Set a baseline standard

Your organisation needs to set a minimum standard for awareness that meets the risk profile of your organisation. That means that everyone gets the same basic foundations. On top of that is the role-specific material.

Same material, role-specific examples

But it can go deeper than that to be more effective. I advocate creating material that is role-specific using the same base material, but having the examples be role-specific. Don't show an HR example to the Shipping department. Keep the examples specific to the role, where practical, but cover the same material so that the foundations are the same. This helps to show why the material is important to the employee.

Train to meet the risks

In addition, different roles in your organisation are going to experience different risks, and those unique risks should be addressed in training. Finance and HR experience different risks and need different tools/procedures to meet those risks. The Shipping department is going to have a completely different set of risks. Training should most definitely be customised to the risks.

Yes, that is going to look daunting to anyone who is not a dedicated security awareness curriculum designer. That is a lot of work. And that's why most organisations do not do it. But they should.

Easy mode: Champions

One way to make it easier is to employ a "Champions" programme where selected individuals in each department/risk area are trained and supported to help design, deliver and be a point of contact for the department/risk-specific material. This has been shown to be extremely effective in many organisations. You should then take the custom material that has been shown to work and roll that into your learning program to make it more consistent and repeatable.

Next step: not just role-specific but audience-specific

In addition, I also advocate having different material for the different technological and demographic groups in your organisation. "How to spot a phish" training needs to look different for people who have never heard of the concept before than for IT experts. And the language and cenceptsconcepts used need to be understood by therthe various demographic groups in your organisation. For example, ask different people whether they know what a "browser" is. You might be shocked to see who has not heard of the term. That means your "How to spot a phish" material needs to either not use the term or train people on it.

Graduated materials

In my materials, I graduate them so that there is a rising skill and knowledge level. People unlock the higher levels when they have shown to be proficient in the lower levels. This means that the IT experts only have to deal with the basic material once, but are challenged by the brand-new techniques in the high levels. New people can grow with the material.

Security Awareness expert here (awards, best-selling book).

Absolutely, you should/need to customise training to the role/risks.

Many international bodies actually call this out as important:

Those where just what I could recall off the top of my head.

But your questions at the end seem to show a misunderstanding about how the materials would be created.

Set a baseline standard

Your organisation needs to set a minimum standard for awareness that meets the risk profile of your organisation. That means that everyone gets the same basic foundations. On top of that is the role-specific material.

Same material, role-specific examples

But it can go deeper than that to be more effective. I advocate creating material that is role-specific using the same base material, but having the examples be role-specific. Don't show an HR example to the Shipping department. Keep the examples specific to the role, where practical, but cover the same material so that the foundations are the same. This helps to show why the material is important to the employee.

Train to meet the risks

In addition, different roles in your organisation are going to experience different risks, and those unique risks should be addressed in training. Finance and HR experience different risks and need different tools/procedures to meet those risks. The Shipping department is going to have a completely different set of risks. Training should most definitely be customised to the risks.

Yes, that is going to look daunting to anyone who is not a dedicated security awareness curriculum designer. That is a lot of work. And that's why most organisations do not do it. But they should.

Easy mode: Champions

One way to make it easier is to employ a "Champions" programme where selected individuals in each department/risk area are trained and supported to help design, deliver and be a point of contact for the department/risk-specific material. This has been shown to be extremely effective in many organisations. You should then take the custom material that has been shown to work and roll that into your learning program to make it more consistent and repeatable.

Next step: not just role-specific but audience-specific

In addition, I also advocate having different material for the different technological and demographic groups in your organisation. "How to spot a phish" training needs to look different for people who have never heard of the concept before than for IT experts. And the language and cencepts used need to be understood by ther various demographic groups in your organisation. For example, ask different people whether they know what a "browser" is. You might be shocked to see who has not heard of the term. That means your "How to spot a phish" material needs to either not use the term or train people on it.

Graduated materials

In my materials, I graduate them so that there is a rising skill and knowledge level. People unlock the higher levels when they have shown to be proficient in the lower levels. This means that the IT experts only have to deal with the basic material once, but are challenged by the brand-new techniques in the high levels. New people can grow with the material.

Security Awareness expert here (awards, best-selling book).

Absolutely, you should/need to customise training to the role/risks.

Many international bodies actually call this out as important:

Those where just what I could recall off the top of my head.

But your questions at the end seem to show a misunderstanding about how the materials would be created.

Set a baseline standard

Your organisation needs to set a minimum standard for awareness that meets the risk profile of your organisation. That means that everyone gets the same basic foundations. On top of that is the role-specific material.

Same material, role-specific examples

But it can go deeper than that to be more effective. I advocate creating material that is role-specific using the same base material, but having the examples be role-specific. Don't show an HR example to the Shipping department. Keep the examples specific to the role, where practical, but cover the same material so that the foundations are the same. This helps to show why the material is important to the employee.

Train to meet the risks

In addition, different roles in your organisation are going to experience different risks, and those unique risks should be addressed in training. Finance and HR experience different risks and need different tools/procedures to meet those risks. The Shipping department is going to have a completely different set of risks. Training should most definitely be customised to the risks.

Yes, that is going to look daunting to anyone who is not a dedicated security awareness curriculum designer. That is a lot of work. And that's why most organisations do not do it. But they should.

Easy mode: Champions

One way to make it easier is to employ a "Champions" programme where selected individuals in each department/risk area are trained and supported to help design, deliver and be a point of contact for the department/risk-specific material. This has been shown to be extremely effective in many organisations. You should then take the custom material that has been shown to work and roll that into your learning program to make it more consistent and repeatable.

Next step: not just role-specific but audience-specific

In addition, I also advocate having different material for the different technological and demographic groups in your organisation. "How to spot a phish" training needs to look different for people who have never heard of the concept before than for IT experts. And the language and concepts used need to be understood by the various demographic groups in your organisation. For example, ask different people whether they know what a "browser" is. You might be shocked to see who has not heard of the term. That means your "How to spot a phish" material needs to either not use the term or train people on it.

Graduated materials

In my materials, I graduate them so that there is a rising skill and knowledge level. People unlock the higher levels when they have shown to be proficient in the lower levels. This means that the IT experts only have to deal with the basic material once, but are challenged by the brand-new techniques in the high levels. New people can grow with the material.

added 793 characters in body
Source Link
schroeder
  • 131.2k
  • 55
  • 306
  • 346

Security Awareness expert here (awards, best-selling book).

Absolutely, you should/need to customise training to the role/risks.

Many international bodies actually call this out as important:

Those where just what I could recall off the top of my head.

But your questions at the end seem to show a misunderstanding about how the materials would be created.

Set a baseline standard

Your organisation needs to set a minimum standard for awareness that meets the risk profile of your organisation. That means that everyone gets the same basic foundations. On top of that is the role-specific material.

Same material, role-specific examples

But it can go deeper than that to be more effective. I advocate creating material that is role-specific using the same base material, but having the examples be role-specific. Don't show an HR example to the Shipping department. Keep the examples specific to the role, where practical, but cover the same material so that the foundations are the same. This helps to show why the material is important to the employee.

Train to meet the risks

In addition, different roles in your organisation are going to experience different risks, and those unique risks should be addressed in training. Finance and HR experience different risks and need different tools/procedures to meet those risks. The Shipping department is going to have a completely different set of risks. Training should most definitely be customised to the risks.

Yes, that is going to look daunting to anyone who is not a dedicated security awareness curriculum designer. That is a lot of work. And that's why most organisations do not do it. But they should.

Easy mode: Champions

One way to make it easier is to employ a "Champions" programme where selected individuals in each department/risk area are trained and supported to help design, deliver and be a point of contact for the department/risk-specific material. This has been shown to be extremely effective in many organisations. You should then take the custom material that has been shown to work and roll that into your learning program to make it more consistent and repeatable.

Next step: not just role-specific but audience-specific

In addition, I also advocate having different material for the different technological and demographic groups in your organisation. "How to spot a phish" training needs to look different for people who have never heard of the concept before than for IT experts. And the language and cencepts used need to be understood by ther various demographic groups in your organisation. For example, ask different people whether they know what a "browser" is. You might be shocked to see who has not heard of the term. That means your "How to spot a phish" material needs to either not use the term or train people on it.

Graduated materials

In my materials, I graduate them so that there is a rising skill and knowledge level. People unlock the higher levels when they have shown to be proficient in the lower levels. This means that the IT experts only have to deal with the basic material once, but are challenged by the brand-new techniques in the high levels. New people can grow with the material.

Security Awareness expert here (awards, best-selling book).

Absolutely, you should/need to customise training to the role/risks.

Many international bodies actually call this out as important:

Those where just what I could recall off the top of my head.

But your questions at the end seem to show a misunderstanding about how the materials would be created.

Your organisation needs to set a minimum standard for awareness that meets the risk profile of your organisation. That means that everyone gets the same basic foundations. On top of that is the role-specific material.

But it can go deeper than that to be more effective. I advocate creating material that is role-specific using the same base material, but having the examples be role-specific. Don't show an HR example to the Shipping department. Keep the examples specific to the role, where practical, but cover the same material so that the foundations are the same. This helps to show why the material is important to the employee.

In addition, different roles in your organisation are going to experience different risks, and those unique risks should be addressed in training. Finance and HR experience different risks and need different tools/procedures to meet those risks. The Shipping department is going to have a completely different set of risks. Training should most definitely be customised to the risks.

Yes, that is going to look daunting to anyone who is not a dedicated security awareness curriculum designer. That is a lot of work. And that's why most organisations do not do it. But they should.

One way to make it easier is to employ a "Champions" programme where selected individuals in each department/risk area are trained and supported to help design, deliver and be a point of contact for the department/risk-specific material. This has been shown to be extremely effective in many organisations. You should then take the custom material that has been shown to work and roll that into your learning program to make it more consistent and repeatable.

In addition, I also advocate having different material for the different technological and demographic groups in your organisation. "How to spot a phish" training needs to look different for people who have never heard of the concept before than for IT experts. In my materials, I graduate them so that there is a rising skill and knowledge level. People unlock the higher levels when they have shown to be proficient in the lower levels. This means that the IT experts only have to deal with the basic material once, but are challenged by the brand-new techniques in the high levels. New people can grow with the material.

Security Awareness expert here (awards, best-selling book).

Absolutely, you should/need to customise training to the role/risks.

Many international bodies actually call this out as important:

Those where just what I could recall off the top of my head.

But your questions at the end seem to show a misunderstanding about how the materials would be created.

Set a baseline standard

Your organisation needs to set a minimum standard for awareness that meets the risk profile of your organisation. That means that everyone gets the same basic foundations. On top of that is the role-specific material.

Same material, role-specific examples

But it can go deeper than that to be more effective. I advocate creating material that is role-specific using the same base material, but having the examples be role-specific. Don't show an HR example to the Shipping department. Keep the examples specific to the role, where practical, but cover the same material so that the foundations are the same. This helps to show why the material is important to the employee.

Train to meet the risks

In addition, different roles in your organisation are going to experience different risks, and those unique risks should be addressed in training. Finance and HR experience different risks and need different tools/procedures to meet those risks. The Shipping department is going to have a completely different set of risks. Training should most definitely be customised to the risks.

Yes, that is going to look daunting to anyone who is not a dedicated security awareness curriculum designer. That is a lot of work. And that's why most organisations do not do it. But they should.

Easy mode: Champions

One way to make it easier is to employ a "Champions" programme where selected individuals in each department/risk area are trained and supported to help design, deliver and be a point of contact for the department/risk-specific material. This has been shown to be extremely effective in many organisations. You should then take the custom material that has been shown to work and roll that into your learning program to make it more consistent and repeatable.

Next step: not just role-specific but audience-specific

In addition, I also advocate having different material for the different technological and demographic groups in your organisation. "How to spot a phish" training needs to look different for people who have never heard of the concept before than for IT experts. And the language and cencepts used need to be understood by ther various demographic groups in your organisation. For example, ask different people whether they know what a "browser" is. You might be shocked to see who has not heard of the term. That means your "How to spot a phish" material needs to either not use the term or train people on it.

Graduated materials

In my materials, I graduate them so that there is a rising skill and knowledge level. People unlock the higher levels when they have shown to be proficient in the lower levels. This means that the IT experts only have to deal with the basic material once, but are challenged by the brand-new techniques in the high levels. New people can grow with the material.

added 793 characters in body
Source Link
schroeder
  • 131.2k
  • 55
  • 306
  • 346
Loading
Source Link
schroeder
  • 131.2k
  • 55
  • 306
  • 346
Loading