Winning the time to effectively communicate to your organization.

Are you looking for insight into the best method of establishing a security training environment within your organization? This is a recurring need across all organizations and one which we will guide you through in this series, titled “Annual Security Training – Design, Develop, and Deliver”.

If you’re wondering why you should focus resources on developing security training programs or missed the first part of the series, go ahead and follow the provided link above. 

There you will learn why security training is important and how to present those “whys” to senior leadership for support. In this installment of the series, we will address the second step in operating a successful training program: Develop. 

The Development Phase

In the previous installment of this series, we addressed the first phase of generating an effective security awareness training program, Design. If you don’t already have a program design in mind, go ahead and follow that link as having a good understanding of the design phase and the content which is to be generated for your training program is important before moving into this one. 

Once the training content is designed, you must determine the frequency of the training and develop a training schedule to ensure the material is effectively conveyed to all employees. The schedule needs to secure enough training time to address all relevant and necessary material. 

How Often Should We Hold Training?

It has come to be generally accepted across industries for security awareness training for all new hires with a frequency of at least annual training for all employees thereafter at a minimum. However, this does not necessarily mean one day out of the year for training. Again, you must keep in mind the desired content to be covered when determining the frequency and duration of training. 

While it may make sense for some companies to condense their annual security awareness training into a single day, a single meeting, or even a single slide deck, that is usually not going to be enough for an effective program. When training is conducted all at once it can overload your employees with information.

This information might be forgotten as the employees get back to their daily tasks, creating an environment almost no better than one without a security training program. Depending on the risk associated with your specific organization and emerging threats related to technology used within your industry, it will likely make more sense to increase that frequency from a single day in a more mature schedule. 

Achieving Consistency

The most effective security training programs generate dynamic training schedules, with continuous short touchpoints throughout the year. By spreading training throughout the year, it maintains security awareness at the forefront of the employee’s mind, integrating it into their daily actions and routines. This type of schedule is most effective at educating employees in long-term security-focused behavior. 

When developing the training schedule for the organization, you should also consider individuals’ levels of responsibility and access to sensitive information. This will allow you to better tailor training and ensure high-risk users receive reinforced training where needed. This may look like additional privacy or sensitive material training for those employees who routinely interact with private healthcare or financial data.

 

Contact

Questions about policies or compliance and where to start? Contact us here! We’d love to chat with you and see how risk3sixty can meet your organization’s needs.