Annual Security Training – Phase 2: Develop

Winning the time to communicate to your organization effectively.

Are you looking for insight into the best method of establishing a security training environment within your organization? This is a recurring need across all organizations and one which we will guide you through in this series, titled “Annual Security Training – Design, Develop, and Deliver”.

If you’re wondering why you should focus resources on developing security training programs or missed the first part of the series, follow the link above. 

You will learn why security training is important and how to present those “whys” to senior leadership for support. In this installment of the series, we will address the second step in operating a successful training program: developing. 

The Development Phase

In the previous installment of this series, we addressed the first phase of generating an effective security awareness training program, Design. If you don’t already have a program design in mind, go ahead and follow that link as having a good understanding of the design phase and the content which is to be generated for your training program is important before moving into this one. 

Once the training content is designed, you must determine the frequency and develop a training schedule to ensure the material is effectively conveyed to all employees. The schedule must secure enough training time to address all relevant and necessary material. 

How Often Should We Hold Training?

It has come to be generally accepted across industries for security awareness training for all new hires with a frequency of at least annual training for all employees thereafter at a minimum. However, this does not necessarily mean one day out of the year for training. Again, you must keep in mind the content you want to cover when determining the frequency and duration of training. 

While it may make sense for some companies to condense their annual security awareness training into a single day, a single meeting, or even a single slide deck, that is usually not enough for an effective program. Conducting training all at once can overload employees with information.

This information might be forgotten as the employees get back to their daily tasks, creating an environment almost no better than one without a security training program. Depending on the risk associated with your specific organization and emerging threats related to technology used within your industry, it will likely make more sense to increase that frequency from a single day in a more mature schedule. 

Achieving Consistency

The most effective security training programs generate dynamic training schedules with continuous short touchpoints throughout the year. By spreading training throughout the year, security awareness is maintained at the forefront of the employees' minds, integrating it into their daily actions and routines. This type of schedule is most effective at educating employees in long-term security-focused behavior. 

When developing the organization's training schedule, you should also consider individuals' levels of responsibility and access to sensitive information. This will allow you to tailor training better and ensure high-risk users receive reinforced training where needed. This may look like additional privacy or sensitive material training for those employees who routinely interact with private healthcare or financial data.

Contact

Questions about policies or compliance and where to start? Contact us here! We'd love to chat with you and see how risk3sixty can meet your organization's needs.