![](https://csdnimg.cn/release/download_crawler_static/5217842/bg13.jpg)
NIST Publication 800-14
NIST's special publication Generally accepted principles and practices for securing information
technology systems, an American national standard recommends seven steps for a security
awareness and training program. These seven steps can be divided into three broad areas of the
program such as identification, management, and evaluation.
In the identification phase, an organization would establish scope, goals and objectives,
training staff identification, and the audience
In managing the program, an organization would motivate the management and
employees; administering as well as maintaining the program
Periodically, an organization will evaluate the program for its effectiveness
ISO/IEC 27002:2005 Information Technology-Security Techniques—Code of
Practice for Information Security Management
This is an acknowledged international standard that provides some of the best practices in
various domains of information security. The following are some of the good practices a security
professional should be aware of, which are related to security awareness and training:
Based on their job function, the standard emphasizes that all employees, and where
relevant, the contractors and the third-party users, should be provided with appropriate
awareness training as well as regular updates in organizational policies and procedures.
The employee induction program should consist of awareness training that covers the
organization's security policies and security expectations. The personnel should undergo
such training before any access to information or services is granted to them.
The training program should contain the security requirements of the organization, legal
responsibilities and business controls, and most importantly, correct usage instructions that
relate to information-processing facilities.
Procedures related to log-on, appropriate usage of systems, networks, software
packages, and also an explanation of disciplinary processes in case of policy or procedure
violations should be part of the training.
The training should also focus on known threats in order to enhance awareness on
security incidents and problems and provides ways to respond to them based on the
personnel's role.
Identifying Security Awareness Needs
As evident from the standards above, it is imperative that security awareness needs must be
established for a proper training program. The following pointers should be considered while
establishing security awareness needs are based on the following:
Business Requirements such as the necessity to protect information. For example, non-
disclosure agreements with the customers, criticality of the information assets, and so on.
Legal/Regulatory/Statutory Requirements. For example, privacy laws, data protection
acts, cyber laws, and so on.
Security policies of the organization. For example, information security policy, access
control policy, acceptable use of assets, and so on.
Incident classifcation and management.
Coverage of Security Awareness Training
Based on the security awareness needs, an organization should, at the minimum level, consider
the following topics for the awareness training programs:
Security roles and responsibilities
Compliance with security policies, standards, and procedures
Commitment of senior management
Acceptable-use policies