Certified Information Security Manager (CISM)Information Security ProgramMedium
A CISO is reviewing the effectiveness of the organization's information security awareness program. Despite regular training sessions and phishing simulations, a significant number of employees continue to click on malicious links and share sensitive information. Which of the following should the CISO investigate FIRST to improve the program's effectiveness?
- AThe technical controls in place to block malicious emails.
- BThe disciplinary actions taken against employees who fail simulations.
- CThe frequency of the training sessions and phishing simulations.
- DThe relevance and engagement level of the training content and delivery methods.
Show answer & explanationAnswer & explanation
Correct answer: D. The relevance and engagement level of the training content and delivery methods.
If employees are still falling for attacks despite training, the primary issue is likely that the training itself isn't effectively changing behavior. Investigating the content's relevance and how engaging it is will help determine if employees are truly internalizing and applying the lessons.
Why the other options are wrong
- A. Technical controls are important, but the problem states employees 'continue to click on malicious links,' indicating human failure, which points back to awareness program effectiveness.
- B. Disciplinary actions might be part of a broader culture strategy but focusing on punishment before understanding why training isn't working is premature and less effective in the long term.
- C. While frequency matters, if the content isn't effective, more frequent ineffective training won't solve the problem.
Awareness Program Effectiveness
The degree to which an information security awareness and training program successfully translates knowledge into desired secure behaviors among employees.
- Measured by behavior change, not just completion rates.
- Dependent on relevant, engaging content.
- Requires continuous reinforcement and feedback.
Memory trick: If the message isn't sticking, first ask if the message itself is clear and captivating.