How do we run awareness training that changes behaviour, not just completion rates?

Start

Completion is high, but you cannot tell whether anything changed

Completion shows that a course was delivered, never that it worked. Training changes behaviour when every activity names, before its content is chosen, the one behaviour it is meant to change, whose behaviour it is, and the measure that will show the change. The rest of this flow builds on that rule.

• Then: Does each activity name one behaviour, whose it is, and its measure?

Decision

Does each activity name one behaviour, whose it is, and its measure?

A topic such as 'phishing' is not a behaviour. A behaviour is one action at work: reporting a suspicious email, calling a supplier back on the number on file, checking a recipient before sending customer data. If any activity lacks one of the three, or you cannot tell, answer no.

• Yes: Should a technical control stop this harm instead?
• No, or not known: Rewrite each topic as one action a person takes at work

Step

Rewrite each topic as one action a person takes at work

The pack starts from five behaviours every joiner hears on day one: report anything odd at once, even after clicking; never give anyone a password or a sign-in code; check before opening a link or attachment you did not expect, and never sign in from a link in an email; confirm any request for money or data by calling a number you already hold; check the recipient before sending customer data. The baseline course adds a sixth: keep your device as IT set it up.

• Then: Should a technical control stop this harm instead?

Decision

Should a technical control stop this harm instead?

A warning, a second factor or a removed right often stops the harm better than any message. Training never stands in for a control, and no message asks people to make up for a control that is missing. If you are not sure, ask the control's owner before writing any content.

• Yes, or not known: Control owner fixes it first; the campaign follows and explains it
• No: Give everyone a short baseline course on those behaviours

Step

Control owner fixes it first; the campaign follows and explains it

The control's owner makes the fix, and the campaign is timed to follow it and say what changed and what it means for the reader. In the pack's example, the theme on devices and updates waited until everyday accounts lost administrator rights, so that its message could explain the change.

• Then: Give everyone a short baseline course on those behaviours

Step

Give everyone a short baseline course on those behaviours

The pack's default is seven five-minute modules, 35 minutes in all, each tied to one behaviour, completed at least every 12 months and in pieces if that suits the work. Everyone with an account takes it, suppliers' staff included unless their contract shows equivalent training. A joiner sees the five behaviours at first sign-in, on the day the account is enabled, and finishes the course within 10 working days of starting.

• Then: Could one mistake in this person's role cause serious harm?

Decision

Could one mistake in this person's role cause serious harm?

Some roles carry access or authority that one mistake or one deceived person can turn into serious harm: privileged access, payment authority, software development, the management body, executive authority, the service desk's identity checks and the handling of customer data. If you are not sure, treat the role as one of them.

• Yes, or not sure: Add the role's module before the access is used unsupervised
• No: Reach people where they work, not only through e-learning

Step

Add the role's module before the access is used unsupervised

A person in a role at higher risk completes that role's module, on top of the baseline course, before using the role's access or authority on their own, and again every 12 months. A joiner works under supervision until it is done; a mover finishes it by the move date. The management body is the exception: its members are trained as the NIS2 pack sets, and the awareness programme sets no other timing for them.

• Then: Reach people where they work, not only through e-learning

Step

Reach people where they work, not only through e-learning

No one channel reaches everyone. Staff without a desk are reached through shift briefings, posters and floor terminals; everyone else also through e-learning, the intranet and team meetings. Keep one behaviour per piece, and the key message in the same words in every channel. Check first who has no email, works nights, reads another language or works from customer sites.

• Then: End every message with the one reporting route, and no blame

Step

End every message with the one reporting route, and no blame

Every activity ends with the same reporting route, named the same way everywhere, and the promise that nobody is blamed for a report made in good faith. A report made after a click is the right behaviour. Thank every report and, where the person asks, say what happened next. No fear, no shame and no league tables.

• Then: Is a practice-email programme approved, and have staff been told?

Decision

Is a practice-email programme approved, and have staff been told?

Practice phishing emails build the reporting habit. None may run until the Head of Information Security, HR, the Data Protection Officer and Legal have approved the programme, staff representatives have been consulted where law or a collective agreement requires it, and staff have been told what is recorded and who sees it.

• Yes: Run practice emails that are judged on reporting
• No, or not known: Hold practice emails until the approvals are in place

Step

Run practice emails that are judged on reporting

Each person receives one about every two months, at a grade the group is ready for, on the month's theme. A click shows a teaching page at once and nothing else. Results are never published, ranked or announced, and names stay with the person and the awareness lead.

• Then: Judge it each month on behaviour, with completion beside it

Step

Hold practice emails until the approvals are in place

Run the themes, messages and courses meanwhile. Practice emails wait for the four sign-offs, the lawful basis recorded with the Data Protection Officer and the announcement to staff. A programme run without them teaches people to distrust the security team and can breach employment and data protection law.

• Then: Judge it each month on behaviour, with completion beside it

Step

Judge it each month on behaviour, with completion beside it

Read the reporting rate, time to first report, repeat clickers as a group share, incidents with a human factor, and role training done by its due date. Show training completion and phishing compromises beside them. Each value carries its target and its status in words. The measures go monthly to the security and IT leadership team, and any short of target or outside green go to executive management with the plan's progress.

• Then: At the annual review, did the theme's behaviour move?

Decision

At the annual review, did the theme's behaviour move?

Once a year, in the plan's last month, the awareness lead compares each theme's measure before and after, at the same grade where it is a practice-email figure. A theme that has not run long enough to tell counts as too soon.

• Yes: Keep the theme in next year's plan
• Too soon to tell: Keep the theme in next year's plan
• No, and the risk remains: Change its channel, audience or copy, and run it again
• Its evidence has gone: Drop the theme, and say why in the annual review note

Outcome

Keep the theme in next year's plan

Keep a theme whose behaviour moved, or which has not yet had a fair chance. Tell staff in the annual review note which themes continue and why, with no practice-email figures.

Outcome

Change its channel, audience or copy, and run it again

Where the behaviour did not move but the risk remains, change the theme's channel, audience or copy. Take the decision into next year's plan, and tell staff in the annual review note which themes change and why.

Outcome

Drop the theme, and say why in the annual review note

A theme whose evidence has gone has no place in the plan: every theme answers an incident, risk or indicator of your own, and a theme that answers none is dropped.