Developing an Effective Security & Compliance Awareness Program

---

See How to Build a Robust & Complete Training Program Easily

---

Security and compliance awareness training is one of the best cybersecurity investments an organization can make. It’s highly effective and companies that make security awareness training a priority enjoy 70% fewer security incidents. But launching a program from scratch can be intimidating. By breaking the development and execution into pieces, it’s easier to handle. Last week, we explored building a strong foundation for your security and compliance awareness training program. This week, we’ll dive into developing your curriculum and evaluating your program’s success.  

Read part 1 of this series, The Secret to Building a Great Security & Compliance Awareness Training Program.

---

Excerpted in part from our eBook How to Build a Security Awareness Training Program. GET IT>> 

---

Develop Your Program 

---

This step focuses on gathering and organizing the nuts and bolts of your program like available training sources, program scope, the training content you’ll be using and the parameters of training for your different training groups. 

Phase 1. Develop Your Curriculum 

NIST offers two excellent questions to kick off this phase of your program development. The answers to these two questions can help you make smart choices about what to teach the participants in your program overall and each training group.  

• “What behavior do we want to reinforce?”  
• “What skill or skills do we want the audience to learn and apply?” 

After you’ve answered those questions for each of your training groups, you should be able to confidently select the right topics to meet the needs and requirements of those groups, especially if different training groups are facing compliance with different regulatory requirements. Does only one group need training about GDPR?  Is everyone getting training about resisting phishing? Laying out the exact training curriculum for each group makes sure that those needs are met.  

It’s also important to make sure that the courses or training materials that you’re using will get the job done effectively. If your training isn’t memorable or interesting, employees will sleepwalk through it and retain nothing.  Consider training with videos. It is highly effective. People are 95% more likely to retain information when conveyed via video than via text alone. 

---

---

Phase 2: Source Your Training Materials 

Now that you know what you need, how will you get it, and how will you deliver it to your learners? This is where your training budget comes into play. You’ve got some hard but important decisions to make here. 

• Is developing materials something that you can handle in-house?  
• Are there industry standard compliance training programs that you should follow?  
• What security and compliance training solutions are available at your price point? 
• Are you better off hiring an expert contractor to handle training? 

---

Set the Wheels in Motion 

---

Now that you’ve got the foundation in place, it’s time to implement your security and compliance awareness training program. This step addresses effective communication and rollout of the awareness and training program.

Phase 1: Share Your Vision 

Now is the time to tell everyone about the new program and its goals. This is probably the most critical step in the entire operation. Your method of doing this depends on your organization’s structure and culture. You might use some combination of email, in-person or online meetings, slideshows, posters, handouts or whatever will best get the message out to everyone. Make sure that your messaging includes: 

• What is expected of every participant, including managers and executives  
• The basic framework of how the program works including procedures, policies, schedules, testing and compliance requirements  
• The expected results of the program and benefits to the organization  

Be prepared to answer specific questions, especially from executives. For example, managers may have questions about funding, like if their budgets will be impacted to cover their department’s share of the expense of implementing the program. Making sure that everyone is on board will go a long way toward making your security awareness and compliance training program successful. Enthusiasm can also be very top-down, so it’s essential to ensure that executives, managers and key employees are invested.  

---

---

Phase 2: Deliver the Training 

After all of your preparation and advertising is complete, it’s time to dive into actually training your users. These 3 tips can help make this phase smoother. 

Monitor Employee and Manager Satisfaction in Real-Time. As you progress through the curriculum, pay careful attention to what employees and managers respond well to and what they don’t. Are the lessons hitting the right notes? Do your users prefer videos? Is the training material too technical? Keep notes of your observations and seek feedback from both employees and managers. 

Have Contingency Plans. All sorts of scenarios can crop up that necessitate making changes or adjustments to your program or curriculum on the fly. Don’t be intimidated by them. Jump in and make important adjustments if they’re needed to make the program successful. There could be a glaring flaw that you didn’t see when designing the program that must be addressed. Your company’s circumstances or makeup could evolve. You could lose key personnel. World events may necessitate change.  Be prepared to deal with contingencies quickly. 

Don’t Be Afraid to Make Waves. Be ready to enforce training schedules and requirements with recalcitrant managers or employees. Are the program’s training schedules and procedures being followed correctly? Is anyone making excuses to avoid training? Are there consequences for non-compliance with the program? Do you need to stress the penalties that employees or managers face for slacking off? In order to facilitate a successful program, you might have to step on a few toes. 

---

---

Review Your Results and Refine Your Program 

---

This step gives guidance on keeping the program current and monitoring its effectiveness. Gathering performance data is critical for determining any changes or adjustments you may need to make as well as demonstrating your program’s success to key stakeholders. Trumpeting positive results to your users is a great way to keep them engaged and invested in security improvements.  

Phase 1: After Action Reporting 

It’s time for your postmortem. To complete this process, you’ll need to gather feedback, analyze your metrics, do your accounting and compile program function data. For this step to be truly effective, you need to be completely honest about the good and bad aspects of your program, like how hard it was to get employees to comply or how employees responded to individual risks. Keep these tips in mind: 

• Employees and managers may have different opinions. Seek feedback from users at every level. 
• Make it clear to employees that you welcome their honest feedback – people love to give their opinions. 
• Don’t just consult users in one training group. Get reviews from every training cohort 
• Encourage everyone to be honest and make sure that they know that what they say will not be used against them. 
• Take a hard look at your budget and how you spent it to make adjustments that will pay off. 
• Make sure that the metrics you’re using to define success align with your KPIs. 

---

---

Determine if you’ve made the most of your resources 

Are you using the right tools? Consider new or alternate technologies and curriculum adjustments to emphasize certain costly risks you may need to increase training around, especially if compliance changes are on the horizon. that you may want to explore for future programs 

Phase 2: Make Plans for the Future 

After you’ve got a solid report on the success of your program, you can plan to make any changes needed in curriculum, scheduling, spending, groups, deployment, content, management and other areas to ensure that your program continues to provide value to your company by effectively promoting security and compliance success. 

---

---

Train Your Way with BullPhish ID 

---

No two organizations are the same, so why use a training solution that doesn’t make it easy to customize your program to fit your organization’s needs? BullPhish ID is the ideal security, compliance and phishing awareness training solution for every company because its many customization options enable you to train your way.  

With BullPhish ID you can:  

• Gain access to a large library of training videos that you can choose from to create the right curriculum for your users.  
• Simplify compliance training with video lessons that make complex requirements easy to understand.  
• Choose from plug-and-play phishing simulation kits or customizable content that can be tailored to fit your industry’s unique threats.  
• Be confident that you’re educating employees about the latest threats or compliance requirements, with at least four new training videos and fresh phishing kits added every month.  
• Training videos are available in eight languages: English, Dutch, French, German, Italian, Portuguese, Spanish (Iberian/European) and Spanish (Latin).  
• Leverage in-lesson quizzes and simple, easy-to-read reports to see the value of training and know who needs additional support.   
• Simplify the training process and make it convenient for every employee with a personalized user portal.   
• Automatically generate and send reports to stakeholders.  

Want to learn more about security awareness training and how BullPhish ID can help secure your company and save you money? Explore the benefits of training with BullPhish ID today.  

Or, book a demo and see BullPhish ID in action! 

---

---