Certifiable standard
ISO/IEC 27001
The international, certifiable standard for building, running and continually improving an information security management system (ISMS).
Focus area · SAT
Security Awareness Training
Building awareness programmes that change behaviour — and meet the training expectations written into major frameworks.
Almost every security framework expects people to be trained: ISO/IEC 27001 requires competence and awareness, PCI DSS requires a formal security awareness programme, and the HIPAA Security Rule includes security awareness and training as an administrative safeguard. Meeting the letter of those requirements is easy. Changing behaviour is harder.
Effective programmes are role-based, short and frequent, tied to real risks the organisation faces, and measured by what people do, such as reporting suspicious messages, rather than by completion rates alone.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
What does this area cover?
- Role-based training design
- Different content for developers, finance teams, executives and administrators.
- Measuring behaviour change
- Reporting rates, time-to-report and repeat-incident trends instead of completion percentages.
- Framework training requirements
- What ISO/IEC 27001, PCI DSS, HIPAA and NIST CSF actually ask for.
- Security culture
- Leadership signals, no-blame reporting and making the secure way the easy way.
Related frameworks
Where does SAT show up in the rules?
Voluntary framework
NIST CSF 2.0
NIST's voluntary, outcome-based framework for understanding, assessing, prioritising and communicating cybersecurity risk, organised into six functions including the new Govern function.
Industry standard
PCI DSS
The global industry standard of technical and operational requirements for any entity that stores, processes or transmits payment account data, or can affect its security.
Law / regulation
HIPAA
US federal law and HHS rules protecting the privacy and security of protected health information held by covered entities and their business associates.