Cisco Certified Support Technician (CCST) CybersecuritySecurity PrinciplesHard
A company is developing a comprehensive security awareness program for its employees. Which of the following is considered the MOST critical first step in establishing an effective security awareness program?
- AConducting annual mandatory cybersecurity training sessions.
- BImplementing a new endpoint detection and response (EDR) solution.
- CIdentifying the target audience and their specific security risks.
- DDistributing phishing test emails to all employees.
Show answer & explanationAnswer & explanation
Correct answer: C. Identifying the target audience and their specific security risks.
An effective security awareness program must be tailored to the specific needs and risks of the organization and its employees. Identifying the target audience and their risks is the foundational step to ensure the program's content is relevant and impactful, making it the most critical first step.
Why the other options are wrong
- A. Mandatory training is a delivery method, but its effectiveness depends on understanding the audience and risks first.
- B. Implementing EDR is a technical control, separate from a human-focused awareness program's initial planning.
- D. Distributing phishing tests is a tactic within a program, not the initial foundational step.
Security Awareness Program
A structured initiative designed to educate employees about cybersecurity threats, best practices, and their role in protecting organizational assets.
- Reduces human error as a security vulnerability.
- Should be continuous, relevant, and engaging.
- Covers topics like phishing, password hygiene, data handling.
Memory trick: Awareness: Know your people, teach them well, keep it fresh, measure success.