Awareness plans are usually split by department, the criterion that ages worst. Which criteria hold up a plan by audience, and how to build the calendar.
Awareness plans are usually split by department, the criterion that ages worst. Which criteria hold up a plan by audience, and how to build the calendar.
Targeted plans cover the areas with a risk hypothesis. What coverage is left for the rest of the organization, and which indicator you can actually report.
Your own incident is the strongest awareness material an organization has. What to tell, what to strip from the account and when to tell it.
Which phishing reporting metrics program owners watch, how the report gets back to the person who sent it, and the two numbers that answer the board.
The security induction lands on the same day as the contract and the accounts. What to keep on day one and what does more spread across the first month.
The time between signing for an awareness program and sending the first campaign rarely depends on the platform. It depends on three internal decisions.
Once an awareness program turns two, novelty stops doing the work. Which formats to rotate, what to leave alone and how to plan the year.
Awareness program continuity gets tested by a vacancy. What keeps running on its own, what was left tied to one person’s name, and what to measure.