- [Instructor] Security awareness programs
must continuously evolve as both business
and security requirements change and new threats emerge.
Security professionals should use their awareness metrics
and industry research to guide the updating
of security awareness efforts.
Any awareness program should include
three important components.
First, security training includes in-person
and online classes and seminars
designed to share important security information
with employees and other stakeholders.
Second, security education provides advanced
formal knowledge of information security
to security practitioners.
Education includes formal degree programs
and other highly structured courses
and certificate programs.
And third, security awareness efforts
are designed to remind employees
of their responsibilities on a routine basis,
keeping security top of mind.
Each of these three components should be updated
during any security awareness program review.
The awareness program review should also verify
the types of awareness, training, and education
provided to each employee and ensure that the level
of knowledge provided to each employee
is appropriate for his or her role in the organization.