Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Who decides…

Who needs more than the standard awareness training, and what?

7 decision pointsThe pack behind this answer: Security Awareness Programme

Add to board memo

The short answer

Recommendation
Give everyone the baseline course, and add a role module wherever one mistake or one deceived person could cause serious harm. The module comes before the role's access or authority is used unsupervised, and is renewed every 12 months.
Reasoning
Phishing, fraud and misdirected data reach everyone, so everyone takes the baseline. Some roles carry access or authority that turns one mistake into serious harm: one captured administrator credential, one payment to a fraudster, one weakness released into production, one reset for the wrong caller. Each such role takes its own module on top of the baseline, completed before the role is used unsupervised and again every 12 months (rule AW-06). A person in several groups takes each group's module.
Considerations
  • The management body is trained under the NIS2 pack's rule. The Directive requires training for every member and sets no interval; at least once a year, and within 3 months for a new member, is the pack's default.
  • A small organisation can merge groups made of the same few people, but keeps a module for each risk: privileged access, payments, development and the service desk's identity checks.
  • A service provider's administrators are privileged users of your systems. Require the module, or equivalent training the contract evidences, and ask for the record.
  • The timings are the pack's defaults. Your own policy may set others.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartEveryone takes the baseline course; some roles need moreDecisionDo they hold an administrator account or admin role?StepPrivileged access module before any right is made eligibleDecisionCan they change bank details, or release or approve payments?StepPayments module before the authority is first usedDecisionDo they write, change or release code or configuration?StepSecure development module before their first change to productionDecisionAre they an executive, or do they run an executive's mail or diary?StepExecutive impersonation module within the induction windowDecisionDo they reset passwords or second factors, or unlock accounts?StepIdentity-check module before their first resetDecisionIs sending customer personal data by email part of their job?StepCustomer data module in the induction window; supervised until doneDecisionAre they a member of the management body?StepManagement body training as the NIS2 pack sets itOutcomeBaseline plus each role's module, renewed every 12 months

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 16 steps.

  1. Start

    Everyone takes the baseline course; some roles need more

    A role is at higher risk when its access or authority lets one mistake or one deceived person cause serious harm. Each such role takes a module of its own on top of the baseline course. Count who is in each group from your role profiles, your privileged accounts and your management body. A person can be in more than one group, and then takes each group's module.

    In the pack

  2. Decision

    Do they hold an administrator account or admin role?

    Everyone with a named administrator account or an application administrator role. One captured administrator credential can compromise every system of its tier. A provider's administrators are privileged users of your systems too. If you are not sure, answer yes.

    In the pack

  3. Step

    Privileged access module before any right is made eligible

    It teaches the rules a privileged user follows, read from the privileged access standard as written there, and what happens after a tier breach. It is done before any privileged right is made eligible. For a provider's administrators, require it, or equivalent training the contract evidences, and ask for the record.

    In the pack

    See also

  4. Decision

    Can they change bank details, or release or approve payments?

    Anyone who can change a supplier's bank details, release a payment run or approve a payment. Payment fraud through a compromised supplier mailbox is the harm it answers.

    In the pack

  5. Step

    Payments module before the authority is first used

    It covers business email compromise, the call-back on every change to supplier bank details, never holding both sides of a payment conflict, and the response playbook. It is done before the authority is first used, then every 12 months, and again within 10 working days of any payment fraud attempt the call-back did not stop.

    In the pack

  6. Decision

    Do they write, change or release code or configuration?

    Everyone who writes, changes or releases code or configuration for the organisation's systems. A weakness written into a system serves every attacker until it is fixed.

    In the pack

  7. Step

    Secure development module before their first change to production

    Keeping secrets out of code and tickets, checking third-party components, review before release, and fixing weaknesses within the vulnerability deadlines. It is done before the person's first change reaches production.

    In the pack

  8. Decision

    Are they an executive, or do they run an executive's mail or diary?

    Executive management, and the assistants who manage their mail and diaries. Their names carry authority that fraudsters borrow, by email, message or cloned voice.

    In the pack

  9. Step

    Executive impersonation module within the induction window

    Why executives and their assistants are targeted, fake urgent requests in an executive's name, and the agreed way to confirm one. It is done within the joiner's induction window: 10 working days from the start date, by the pack's default.

    In the pack

  10. Decision

    Do they reset passwords or second factors, or unlock accounts?

    Everyone who resets a password or a second factor, or unlocks an account. A caller who talks the service desk into a reset gets the account without phishing anyone.

    In the pack

  11. Step

    Identity-check module before their first reset

    Callers who impersonate staff, the identity checks before any reset (a call back, the line manager's confirmation, or in person), and the stricter checks for a privileged account. It is done before the person's first reset.

    In the pack

    See also

  12. Decision

    Is sending customer personal data by email part of their job?

    A misdirected customer file is a personal data breach. People whose job is to send customer personal data by email take a role module of their own.

    In the pack

  13. Step

    Customer data module in the induction window; supervised until done

    Sending customer data only to checked recipients, using the shared file route for bulk data, and reporting a misdirected email within the hour. The person works under supervision until the module is done.

    In the pack

  14. Decision

    Are they a member of the management body?

    Members of the management body are trained as the NIS2 pack sets, with attendance and content recorded. The awareness programme sets no other timing for them.

    In the pack

  15. Step

    Management body training as the NIS2 pack sets it

    At least once a year, and within 3 months of a new member's appointment, by the NIS2 pack's default, recorded in that pack's training plan. It covers the organisation's NIS2 status, the measures and where they stand, the top cyber risks and appetite, incidents, supervision and personal accountability, and how to read and challenge the cyber report.

    In the pack

    See also

  16. Outcome

    Baseline plus each role's module, renewed every 12 months

    A joiner works under supervision until a role module is done. A mover finishes the new group's module by the move date; a move within the same group carries it over. A small organisation can merge groups made of the same few people, but keeps a module for each risk. Record each completion, with the module's version, in your own training register.

    In the pack

Practical checklist

  1. List who is in each group from your role profiles, your privileged accounts and your management body's membership.
  2. Give privileged users their module before any privileged right is made eligible.
  3. Give people with payment authority, developers and the service desk their modules before the first payment, the first change to production or the first reset.
  4. Give executives, their assistants and customer data handlers their modules within the induction window, with joiners supervised until done.
  5. Train the management body as the NIS2 pack sets, with attendance and content recorded.
  6. Make movers finish the new group's module by the move date.
  7. Renew every module every 12 months.

Evidence to have ready

  • The role groups, who is in each and where each count comes from.
  • Each person's role module completion, with the module's version, in your own training register.
  • The management body's attendance and the content covered, for each member.
  • A coverage check showing nobody using a role's access or authority unsupervised without its module.

Assumptions

  • Everyone with an account already takes a baseline course at least every 12 months, the pack's default.
  • You can list who holds each role from your role profiles, your privileged account inventory and your management body's membership.
  • The timings shown are the CISO Times awareness pack's defaults, and the NIS2 pack's for the management body. Your own policy may set others.

Not covered here