Which Part of the Awareness Program?

About this interactive

The Security Awareness and Training Management lesson starts with the biggest risk to an organisation: its employees, because attackers know how to manipulate them. An awareness program is how a security program fights back, and the lesson builds one from four parts. Signed policies: employees sign an acceptable use policy, and the lesson also likes a separate password policy, because passwords matter that much. Signing makes people read and accept the rules. The handbook and messages: the employee handbook carries the policies and security guidance new hires see at onboarding, and periodic emails and instant messages repeat a point or warn about something current. Training: at least once a year, perhaps quarterly or spread through the year, to teach security principles. Testing: simulated phishing campaigns and similar tests, sent after training to see who falls for them. The lesson's experience is that without testing, people keep failing to apply what they were taught. The question for each card is what it is for: getting a commitment (policy), keeping information in front of people (handbook and messages), teaching (training), or checking what people actually do (testing).

What you'll learn

Identify the part of a security awareness program an activity belongs to: a signed policy, the handbook or a message, training, or testing
Explain why testing such as simulated phishing follows training, and why signed policies and periodic messages keep awareness up between sessions

Aligned to

CompTIA Security+

5.6 Given a scenario, implement security awareness practices.

5.1 Summarize elements of effective security governance.

Key terms

Security Awareness Training: An ongoing program that educates employees about cybersecurity threats, safe practices, and organizational policies to reduce human-based risk. Effective training covers topics like phishing recognition, password hygiene, and social engineering.
Acceptable Use Policy: A documented policy that defines the rules and expectations for how employees and internal users may use organizational systems and resources. An AUP establishes the grounds for disciplinary or legal action if violated.
Password Policy: A set of organizational rules governing the creation, complexity, expiration, and management of user passwords to reduce security risk.
Phishing Simulation: A controlled exercise that sends fake phishing emails to employees to test and reinforce their ability to recognize and report phishing attempts.
Social Engineering: A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.

Topics

Security Awareness Phishing Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →