{"data":{"id":"SP-014","slug":"awareness-and-training","joomla_id":277,"title":"Awareness and Training Pattern","description":"Security architecture for building and sustaining an effective security awareness and training program. Covers role-based training, phishing simulation, security culture, third-party personnel, incident reporting behaviour, and compliance training obligations.","url":"https://www.opensecurityarchitecture.org/patterns/sp-014","metadata":{"release":"26.02","classification":"Governance & People","status":"published","type":"pattern","datePublished":"2010-05-02","dateModified":"2026-02-06","authors":["Aurelius","Vitruvius"],"reviewers":[]},"diagram":{"svg":"/images/patterns/08_02_Pattern_014_01_Awareness.svg","png":"/images/patterns/08_02_Pattern_014_01_Awareness.png"},"content":{"description":"Every security control ultimately depends on people. Firewalls can be misconfigured, access policies can be overridden, encryption can be bypassed -- and in almost every case, a human decision is in the chain. The Awareness and Training pattern addresses the most persistent and exploitable vulnerability in any security architecture: human behaviour.\n\nThis is not a pattern about annual compliance checkboxes. Organisations that treat awareness as a yearly e-learning module followed by a quiz are measuring completion rates, not security outcomes. Effective awareness and training programs are continuous, role-targeted, behaviour-changing, and measurable. They create a security culture where reporting a suspicious email is instinctive, where developers think about input validation before they write code, and where executives understand that security investment is risk management, not cost overhead.\n\nThe pattern operates across three tiers. First, baseline awareness for all personnel: organisation-wide security culture, acceptable use, data handling, physical security, and social engineering recognition. Second, role-based training for positions with elevated security responsibilities: system administrators, developers, incident responders, data handlers, and privileged access holders. Third, specialist certification and continuous development for security professionals, auditors, and compliance officers.\n\nThird-party personnel -- contractors, consultants, outsourced service providers -- require equivalent coverage. An organisation's security posture is only as strong as the least-aware person with access to its systems. Supply chain breaches increasingly originate from compromised third-party credentials obtained through social engineering attacks that proper awareness training would have prevented.\n\nThe pattern also addresses the measurement problem. Traditional metrics (completion rates, quiz scores) measure participation, not effectiveness. Modern programs use phishing simulation click rates over time, time-to-report for suspicious activity, incident volumes by category, and pre/post assessment scores to demonstrate genuine behavioural change. These metrics feed back into program design, creating an adaptive loop where training content evolves in response to observed weaknesses.","keyControlAreas":["Security Awareness Program (AT-02, AT-01): The awareness program is the foundation. It must reach all personnel including employees, contractors, temporary staff, and third parties with system access. Content should cover: recognising social engineering and phishing attempts, data classification and handling obligations, acceptable use of systems and services, physical security (tailgating, clean desk, secure printing), incident reporting procedures, and the consequences of policy violations. Delivery should be continuous and multi-channel -- not a single annual session. Techniques include simulated phishing campaigns, short-form video, posters in common areas, security newsletters, gamified learning, and real-world case studies drawn from actual incidents (anonymised) within the organisation or industry. The program must be documented with clear ownership, typically shared between the CISO function and internal communications.","Role-Based Security Training (AT-03, PS-02, AT-04): Generic awareness is necessary but insufficient. Personnel in security-sensitive roles require targeted training calibrated to their specific risks and responsibilities. Position categorisation (PS-02) identifies which roles require enhanced training: system administrators need training on secure configuration and privilege management; developers need secure coding, OWASP Top 10, and secure SDLC practices; data handlers need classification procedures and breach notification obligations; executives and board members need governance-level risk understanding and decision-making frameworks; incident responders need exercise-based training on detection, containment, and evidence preservation. Training records (AT-04) must demonstrate that the right people received the right training at the right time -- this is a core audit evidence requirement across ISO 27001, SOC 2, PCI DSS, and most regulatory frameworks.","Personnel Security Lifecycle (PS-03, PS-04, PS-05, PS-06): Security awareness is not a point-in-time event -- it follows the personnel lifecycle. Pre-employment screening (PS-03) establishes the baseline: background checks proportionate to role sensitivity, verification of qualifications and references, and criminal record checks where legally permitted and role-appropriate. Access agreements (PS-06) ensure personnel formally acknowledge their security obligations before receiving system access. When personnel transfer between roles (PS-05), training must be updated to reflect new responsibilities and access levels -- a developer moving into a DevOps role inherits new privileged access that requires corresponding training. At termination (PS-04), off-boarding procedures must include return of assets, access revocation, and reminders of continuing obligations such as NDAs and data handling commitments.","Third-Party Personnel Security (PS-07, PS-08, SA-09 from related patterns): Third parties with access to organisational systems or data represent a significant and growing attack surface. Awareness requirements should be contractually mandated and verified. This includes: requiring third-party personnel to complete organisation-specific security awareness training before receiving access; including security training obligations in vendor contracts and SLAs; conducting periodic assessments of third-party security awareness posture; and ensuring sanctions (PS-08) can be applied for third-party security violations through contractual mechanisms. The organisation should maintain a register of third-party personnel with system access and their training completion status.","Incident Response and Reporting Culture (IR-02, PL-04): A well-trained workforce is the best early warning system. Staff who recognise and promptly report suspicious activity dramatically reduce attacker dwell time. Incident response training (IR-02) should be practical and exercise-based: tabletop exercises for management, hands-on simulations for technical staff, and clear, simple reporting procedures for all personnel. Rules of behaviour (PL-04) should explicitly define what constitutes a reportable event and emphasise that reporting is always the right action -- even false positives. A blame-free reporting culture is essential; organisations that punish staff for falling victim to sophisticated social engineering attacks drive incidents underground rather than eliminating them.","Contingency and Business Continuity Awareness (CP-03): Personnel must understand their roles during disruptive events. Contingency training ensures staff know the business continuity plan, their responsibilities during an incident, communication procedures when primary channels are unavailable, and recovery priorities. This is especially important for personnel who do not work in IT or security but whose cooperation is essential during a crisis. Regular exercises validate that training has been effective and identify gaps.","Risk-Informed Program Design (RA-03): The awareness and training program should be driven by risk assessment, not by generic templates. Identify the organisation's actual threat landscape: what social engineering techniques are being used against your industry? What are the most common causes of security incidents in your organisation? Where are the knowledge gaps? Use threat intelligence, incident data, and phishing simulation results to continuously refine training content and targeting. A financial services firm facing business email compromise should weight training differently from a healthcare organisation facing ransomware delivered via phishing."],"assumptions":"The organisation has a defined information security policy framework that awareness and training can reference. Management commitment exists to fund and support the program -- awareness without executive sponsorship is performative. Personnel have allocated time for training activities during working hours. The organisation has mechanisms to track training completion and measure effectiveness. For third-party coverage, contractual authority exists to mandate training compliance. Content delivery infrastructure (LMS, email, intranet) is available. The threat landscape is dynamic and the program must adapt -- training content from two years ago is already partially obsolete.","typicalChallenges":"Engagement fatigue is the primary challenge: staff who view security awareness as a bureaucratic checkbox will not change behaviour regardless of content quality. Combat this through variety in delivery, relevance to role, real-world examples, and executive visible participation. Measuring genuine effectiveness versus completion rates requires investment in simulation tools and analytics. Budget constraints often reduce awareness programs to the minimum required for compliance, which is insufficient for actual risk reduction. Reaching third-party personnel who may not use the organisation's systems for training delivery. Keeping content current as threats evolve -- phishing techniques, social engineering tactics, and technology risks change faster than annual training cycles. Multilingual and multi-cultural workforces require localised content. Remote and hybrid workforces are harder to reach with physical security messaging and more susceptible to certain attack vectors. Shadow IT and personal device usage create awareness gaps that organisational training cannot fully address. Balancing security messaging with productivity -- excessive warnings create alert fatigue and are counterproductive.","indications":"All organisations that employ people or engage third parties with system access should implement this pattern. It is universally applicable and is a mandatory requirement under virtually every compliance framework (ISO 27001 A.6.3, NIST CSF GV.AT, PCI DSS 12.6, SOC 2 CC1.4, CIS Control 14). Specific triggers for enhanced investment: high phishing click rates in simulation; repeat security incidents caused by human error; regulatory findings citing training deficiencies; significant organisational growth or transformation; adoption of new technologies (cloud, AI, remote work) that change the risk profile; or industry-specific regulations mandating awareness programs (financial services, healthcare, critical infrastructure).","contraIndications":"There are no legitimate contra-indications for this pattern. Any organisation with personnel and information systems requires security awareness. The scope and depth should be proportionate to the organisation's risk profile, but a zero-investment approach is never appropriate. Even very small organisations benefit from basic security hygiene awareness.","threatResistance":"Social engineering and phishing -- the most common initial attack vector in breach data year after year, with trained staff providing the primary defence layer. Business email compromise targeting finance and executive personnel. Insider threats, both malicious and negligent -- awareness of monitoring, policy, and consequences deters deliberate misuse while training reduces accidental incidents. Credential compromise through weak passwords, password reuse, and credential sharing -- awareness drives adoption of password managers and MFA. Data handling errors including misclassification, misdirected communications, and improper disposal. Physical security breaches including tailgating, unsecured workstations, and improper document disposal. Shadow IT and unauthorised service usage where employees bypass approved channels. Regulatory non-compliance where training requirements are unmet. Supply chain and third-party personnel exploitation. Delayed incident reporting that increases attacker dwell time and breach impact."},"examples":{"Baseline awareness programs":["KnowBe4 security awareness training platform with simulated phishing","Proofpoint Security Awareness Training (formerly Wombat)","SANS Security Awareness (end-user focused modules)","Cofense PhishMe phishing simulation and reporting","Microsoft Attack Simulation Training in Defender for Office 365"],"Role-based technical training":["SANS Institute role-specific courses (SEC401, SEC504, DEV522, etc.)","Offensive Security certifications (OSCP, OSWP) for penetration testers","ISC2 CISSP/CCSP for security architects and managers","ISACA CISM/CISA for governance and audit professionals","Cloud provider security certifications (AWS Security Specialty, Azure Security Engineer)"],"Executive and board programs":["NACD Cyber-Risk Oversight handbook and director education","World Economic Forum Cyber Resilience guidance for boards","Industry-specific executive briefings (FS-ISAC, Health-ISAC)","Tabletop exercises with board participation for major incident scenarios"],"Compliance-driven training":["PCI DSS 12.6 annual security awareness for all personnel with cardholder data access","HIPAA Security Rule training for healthcare workforce members","GDPR awareness training covering data subject rights and breach notification","SOX IT controls training for personnel involved in financial reporting systems"],"Developing Areas":["AI-generated phishing is rendering traditional awareness training increasingly inadequate. Large language models produce grammatically flawless, contextually personalised phishing emails that lack the spelling errors and awkward phrasing that users were trained to detect. AI-generated voice clones (vishing) and real-time video deepfakes in video calls are emerging attack vectors that existing training programmes do not address. The training industry is scrambling to develop exercises that teach users to verify requests through out-of-band channels rather than relying on content-based detection of social engineering attempts.","Measuring security culture as distinct from training compliance is an evolving discipline with no consensus methodology. Traditional metrics (completion rates, phishing simulation click rates) measure behaviour in test conditions, not genuine cultural embedding. Emerging approaches use sentiment analysis of internal communications, voluntary security reporting rates, time-to-report for genuine incidents, and anonymous culture surveys with psychometric frameworks adapted from safety culture research. However, correlating these culture metrics with actual security outcomes (breach rates, incident severity) requires longitudinal data that most organisations have not yet accumulated.","Personalised adaptive training platforms that adjust content difficulty, topic selection, and delivery frequency based on individual user behaviour are emerging but adoption is limited. These platforms use machine learning to identify which users are most susceptible to specific attack types and deliver targeted micro-training at the moment of highest receptivity. Early evidence suggests 30-40% better retention compared to one-size-fits-all annual training, but the data requirements for personalisation raise privacy concerns that European organisations in particular must navigate carefully under GDPR worker monitoring provisions.","Deepfake awareness for voice and video communications is becoming an urgent training need as the technology required to clone voices from short audio samples becomes freely available. Reported incidents of AI-generated voice calls impersonating executives to authorise wire transfers have increased dramatically, with individual losses exceeding $25 million in documented cases. Training programmes must now cover verification procedures for verbal instructions, particularly for financial transactions and privileged access requests, but the training content and simulation tools for deepfake awareness are still in early development."]},"references":[{"title":"NIST SP 800-50 Rev 1: Building a Cybersecurity and Privacy Learning Program","url":"https://csrc.nist.gov/pubs/sp/800/50/r1/final","note":"NIST guidance on building and managing a cybersecurity and privacy learning programme through its life cycle, covering awareness, training and education, with suggested metrics and evaluation methods. Rev 1 (September 2024) replaced both SP 800-50 and SP 800-16."},{"title":"SANS Security Awareness Report","url":"https://www.sans.org/security-awareness-training/resources/reports/","note":"Annual industry report on the state of security awareness programs, maturity models, and best practices. Provides benchmarking data across industries."},{"title":"ENISA Cybersecurity Culture Guidelines","url":"https://www.enisa.europa.eu/publications/cybersecurity-culture-guidelines-behavioural-aspects-of-cybersecurity","note":"European approach to building cybersecurity culture beyond training, addressing behavioural science principles and organisational culture change."},{"title":"ISO 27001:2022 Clause 7.2 and 7.3 (Competence and Awareness)","url":"https://www.iso.org/standard/27001","note":"ISO requirements for competence determination, training provision, awareness of security policy, and retention of evidence of competence. Annex A.6.3 covers information security awareness, education, and training."},{"title":"Verizon Data Breach Investigations Report (DBIR)","url":"https://www.verizon.com/business/resources/reports/dbir/","note":"Annual analysis of breach data consistently showing human factors (phishing, credential misuse, errors) as leading breach vectors. Essential for evidence-based training program design."},{"title":"CISA Cybersecurity Awareness Program","url":"https://www.cisa.gov/resources-tools/programs/cisa-cybersecurity-awareness-program","note":"US Cybersecurity and Infrastructure Security Agency resources including the annual Cybersecurity Awareness Month toolkit and sector-specific guidance."}],"relatedPatterns":["SP-010","SP-013","SP-018","SP-025","SP-027"],"relatedPatternNames":["Identity Management","Data Security","Information Security Management System","Advanced Monitoring and Detection","Secure LLM Usage"],"threats":[{"id":"T-AT-001","name":"Social Engineering and Phishing","mitigatedBy":["AT-02","AT-03","IR-02","PL-04"]},{"id":"T-AT-002","name":"Insider Threat (Malicious or Negligent)","mitigatedBy":["PS-02","PS-03","PS-06","PS-08","AT-02"]},{"id":"T-AT-003","name":"Credential Compromise (Weak Passwords, Sharing, Reuse)","mitigatedBy":["AT-02","AT-03","PL-04","PS-06"]},{"id":"T-AT-004","name":"Policy Non-Compliance and Shadow IT","mitigatedBy":["AT-02","PL-04","PS-08","AT-01"]},{"id":"T-AT-005","name":"Data Handling Errors (Misclassification, Misdirection)","mitigatedBy":["AT-03","AT-02","PL-04","PS-06"]},{"id":"T-AT-006","name":"Physical Security Breaches (Tailgating, Clean Desk Failures)","mitigatedBy":["AT-02","PL-04","PS-08"]},{"id":"T-AT-007","name":"Third-Party Personnel Security Failures","mitigatedBy":["PS-07","PS-03","AT-02","PS-06"]},{"id":"T-AT-008","name":"Delayed Incident Reporting","mitigatedBy":["IR-02","AT-02","PL-04","AT-01"]},{"id":"T-AT-009","name":"Business Continuity Failures Due to Untrained Personnel","mitigatedBy":["CP-03","AT-03","IR-02"]},{"id":"T-AT-010","name":"Regulatory Non-Compliance (Training Obligations)","mitigatedBy":["AT-01","AT-04","PS-06","RA-03"]}],"controls":[{"id":"AT-01","name":"Policy and Procedures","family":"AT","emphasis":"important"},{"id":"AT-02","name":"Literacy Training and Awareness","family":"AT","emphasis":"critical"},{"id":"AT-03","name":"Role-based Training","family":"AT","emphasis":"critical"},{"id":"AT-04","name":"Training Records","family":"AT","emphasis":"important"},{"id":"AT-05","name":"Contacts with Security Groups and Associations","family":"AT","emphasis":"standard"},{"id":"CP-03","name":"Contingency Training","family":"CP","emphasis":"standard"},{"id":"IR-02","name":"Incident Response Training","family":"IR","emphasis":"important"},{"id":"PL-04","name":"Rules of Behavior","family":"PL","emphasis":"important"},{"id":"PS-01","name":"Policy and Procedures","family":"PS","emphasis":"important"},{"id":"PS-02","name":"Position Risk Designation","family":"PS","emphasis":"important"},{"id":"PS-03","name":"Personnel Screening","family":"PS","emphasis":"important"},{"id":"PS-04","name":"Personnel Termination","family":"PS","emphasis":"standard"},{"id":"PS-05","name":"Personnel Transfer","family":"PS","emphasis":"standard"},{"id":"PS-06","name":"Access Agreements","family":"PS","emphasis":"critical"},{"id":"PS-07","name":"External Personnel Security","family":"PS","emphasis":"important"},{"id":"PS-08","name":"Personnel Sanctions","family":"PS","emphasis":"important"},{"id":"RA-03","name":"Risk Assessment","family":"RA","emphasis":"important"}],"controlFamilySummary":{"AT":5,"CP":1,"IR":1,"PL":1,"PS":8,"RA":1}}}