Security Awareness Program

Security awareness should be ongoing within the organization. That's why a security plan is necessary.

Make a plan

A security plan should outline all the methods, trainings and activities that promote a security culture (e.g. social engineering exercises, security courses, etc.).

The plan should typically be for a year, should be reviewed at the end of the year, and signed-off by Executives. 

Control objectives

• Program is documented, followed, reviewed, and updated regularly
• Includes annual information security course for employees
• Educate users on common threats and impacts to business such as not sharing credentials, not clicking on suspicious links and attachments, reporting security incidents, maintaining clean desk, locking inactive systems, and concealing valuables
• Should be tailored for the employee roles
• Annual sign off of the plan