How do we plan a year of awareness from our own incidents and risks?

Start

You need next year's awareness plan, built from your own evidence

A plan built from a generic topic list trains people on someone else's risks. Every theme must name the incident, risk or indicator it answers, and a theme that answers none is dropped. The awareness lead proposes the plan.

• Then: Gather the five evidence sources

Step

Gather the five evidence sources

Read the incident log for root causes with a human factor, and for incidents staff stopped or reported early; the risk register for risks caused by people's behaviour, their owners and how far each is from appetite; key risk indicators on people risks, such as phishing compromises; last year's practice-email results; and findings from exercises, audits and access reviews. Write what happened, never who. Where a provider runs IT, ask it for its incident reports and phishing figures each quarter.

• Then: Write each finding as one action a person takes or fails to take

Step

Write each finding as one action a person takes or fails to take

Never a topic. A takeover after a fake sign-in page becomes 'gave away a password or code'; a misdirected file becomes 'sent data to the wrong person'. Each behaviour is what a theme will try to change.

• Then: Should a control stop this harm, rather than a campaign?

Decision

Should a control stop this harm, rather than a campaign?

A warning, a second factor or a removed right often stops the harm better than any message. Where one should, its owner fixes it, and the campaign is timed to follow the fix and explain it. A campaign never replaces the fix. If you cannot tell, ask the control's owner.

• Yes, or not known: Time the theme after the fix, and name the action it follows
• No: Rank the behaviours by risk

Step

Time the theme after the fix, and name the action it follows

Name the review action or treatment action the theme follows beside it in the plan. In the pack's example, the sign-in codes theme follows the move to an authenticator app, and explains the new app.

• Then: Rank the behaviours by risk

Step

Rank the behaviours by risk

Put first the behaviours whose linked risk is outside appetite or whose indicator is amber, then order the rest by how many incidents each caused.

• Then: Name the role groups and the channels that reach them

Step

Name the role groups and the channels that reach them

Say whose behaviour each theme targets: everyone, or a group such as payment staff or the service desk. Then name the channels that reach them: shift briefings and floor terminals for people without a desk, e-learning for others.

• Then: Set each theme's measure before writing its content

Step

Set each theme's measure before writing its content

A theme whose behaviour is a report is judged on the reporting rate or the time to first report. A theme whose behaviour prevents harm is judged on incidents with that human factor. Choose the measure now, so that the annual review has something to judge.

• Then: Does every piece of evidence have a theme, or a reason why not?

Decision

Does every piece of evidence have a theme, or a reason why not?

Check both ways. Each incident, risk or indicator on your list needs a theme, or a recorded reason why not. Each theme needs evidence behind it, or it is dropped.

• Yes: Can you run a theme every month?
• No, or not sure: Add a theme, or record what else answers that evidence

Step

Add a theme, or record what else answers that evidence

Some evidence is better answered elsewhere. In the pack's example, misuse of privileged access has no campaign for everyone: the privileged access module and the privileged access controls answer it, and the plan records that reason.

• Then: Can you run a theme every month?

Decision

Can you run a theme every month?

A monthly campaign needs time for messages, briefings and, where planned, a practice email. A small organisation can run one theme a quarter with one awareness lead. Either way, keep the evidence behind every theme, the reporting route in every message and the re-plan triggers.

• Yes: Place one theme a month, most urgent first, review last
• No: a small team: Place one theme a quarter, from your own incidents

Step

Place one theme a month, most urgent first, review last

Twelve themes: the most urgent first, a practice email in each month where it fits, and the last month kept for the annual review. Send each group a practice email no more than once every two months. Keep each month's theme as approved beside any later change, so the plan shows what each re-plan moved.

• Then: Risk owners agree; executive management approves before the year

Step

Place one theme a quarter, from your own incidents

Choose the themes that answer your own incidents, most urgent first. The rest of the method is the same.

• Then: Risk owners agree; executive management approves before the year

Step

Risk owners agree; executive management approves before the year

The awareness lead proposes the plan. The owner of each risk it answers agrees the themes for that risk, and executive management approves the plan before the year starts, with an executive sponsor named. A regulated entity keeps each year's approved plan and its record of re-plans.

• Then: Each month, read the measures and look for triggers

Step

Each month, read the measures and look for triggers

The security and IT leadership team reads the measures every month, and executive management sees any measure short of target or outside green, with the plan's progress and the re-plans made. Read key risk indicators every month, the risk register every quarter, and the incident log every quarter and after every Severity 1 or 2 incident.

• Then: Has a re-plan trigger arisen?

Decision

Has a re-plan trigger arisen?

Four triggers: an incident declared at Severity 1 or 2 with a human factor; the same human factor causing two incidents within 3 months; a key risk indicator on a people risk entering amber or red; a new risk in the register caused by people's behaviour. If you are not sure whether an incident had a human factor, treat it as a trigger and judge it at the re-plan.

• Yes, or not known: Re-plan within 10 working days, and record what moved
• No: the year runs to its end: Year end: keep, change or drop each theme on its evidence

Step

Re-plan within 10 working days, and record what moved

Move the themes the trigger calls for, within 10 working days of the day it arose. The owner of each risk the moved themes answer and the executive sponsor agree the change, recorded with its trigger and what moved. The month's launch message says that the theme moved and why, naming no one.

• Then: Each month, read the measures and look for triggers (back to an earlier step)

Outcome

Year end: keep, change or drop each theme on its evidence

In the last month, the awareness lead and the executive sponsor judge whether each theme changed the behaviour it named. The next plan keeps it, changes its channel, audience or copy, or drops it, and staff hear the result in the annual review note.