Human Risk Metrics Dashboard
Reports reporting rates, repeat clickers, training completion and incident attribution to human factors.
Available soon
- Format
- Excel
- Size
- 100 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | On Measure Settings, keep one row per measure: HRM-01, HRM-02, HRM-03, HRM-04, HRM-05, MC-36, MC-34. Enter the unit, whether higher or lower is better, and for each P16 measure its target and tolerance limit as your security and IT leadership team sets them (P11 MR-07). MC-36 and MC-34 keep the metrics pack's definition, target and thresholds (P11 MR-04): change them only there. |
| 2 | On Campaigns, enter each simulation when its window closes (5 working days after it is sent): the group, the grade, the theme, the recipients and the counts the platform gives. The rates, the window and the grade the progression rule gives calculate. Read the reporting rate first: the behaviour the programme exists to build: a reported attack can be stopped for everyone. |
| 3 | On Human Factors, judge every incident in the case log (P09) for a human factor, from its root cause: An incident has a human factor when its root cause in the case log includes something a person did or did not do: a click, a credential or code given away, data sent to the wrong person, a procedure not followed. It is recorded as what happened, never as who. The control that should have stopped it is recorded beside it, and the awareness response never replaces fixing that control (AW-02). |
| 4 | On Monthly Values, enter each month's values for the measures that are not calculated here: HRM-03, HRM-05, MC-36, MC-34. Use the month's last day, the value and 'Out of' for a share, and the value in words. Never copy last month's value forward. Mark 'Break in series' when the definition or source changed this month (P11 MR-09). |
| 5 | Every measure's owner writes the commentary on Monthly Values for the month, including for the calculated measures. A measure short of target, or a KRI out of green, needs it: the Check column on Measure Settings says where it is missing. |
| 6 | On the Dashboard, enter the report month (its last day) and the as-at date. Type both; never a formula that changes them. Read the status words, the comparisons and the commentary. |
| 7 | Take the Dashboard to the security and IT leadership team every month, and the measures short of target or outside green, with the plan's progress, to executive management in the executive committee's monthly report (P11 RL-2, AW-16). The board sees completion through P03 BM-08. Keep a copy of each month's workbook. |
| 8 | Delete the EXAMPLE rows before use. Do not type over the white calculated columns. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule AW-15: "The programme must be judged on behaviour: the human risk measures HRM-01 to HRM-05, with training completion (P11 MC-36) and phishing compromises (P11 MC-34) beside them, each with its target and status in words (P11 MR-12). Where another pack defines a measure, its definition and target are used unchanged (P11 MR-04). Simulation figures are compared only at the same grade: a change of grade is a break in series (P11 MR-09)."
Rule AW-16: "The measures must go monthly to the security and IT leadership team, and monthly to executive management in the metrics programme's executive report, which shows any measure short of target or outside green with the plan's progress (P11). Completion reaches the board through P03 BM-08. Once a year the awareness lead reviews whether each theme changed the behaviour it named, and the next plan keeps, changes or drops it on that evidence."
P11 MR-12: "Every value must be shown with its target or thresholds, its direction since the last period and its status in words (P03 BR-04). Never colour alone, never a combined index, and never a score out of 100."
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026, as at 30 Sep 2026. Completion is 92%, which says people took the course. Behaviour says more: reporting rose from 22% to 28% at a harder grade, the first report now comes within 4 minutes, and staff reported 83 suspicious emails in September. It is not yet enough: 3 of the quarter's 5 incidents had a human factor, and phishing compromises are amber.
Tailoring — small organisation: report the five human risk measures and the two imported ones quarterly if a month has too few events to read. Keep every value's target, comparison and status in words, and never report a group smaller than the minimum.
Tailoring — regulated entity (NIS2, DORA): the dashboard is the record that the awareness programme and the role training are tested for effectiveness (Implementing Regulation (EU) 2024/2690, Annex points 8.1.3 and 8.2.3). Keep each month's copy.
Tailoring — simulations or IT run by a service provider: the provider's platform report is an input, never the dashboard. Take its counts onto the Campaigns sheet, and keep the judgement of human factors yourself.
Dashboard
Human risk metrics: monthly dashboard
For the security and IT leadership team. Yellow cells are yours; everything else is calculated. Every status is in words; the colour only repeats it. No score and no names (AW-13, P11 MR-12).
Report settings
| Setting | Value | |
|---|---|---|
| Month (its last day) | 30 Sep 2026 | EXAMPLE: the month the figures describe. |
| As-at date (the day you read it) | 30 Sep 2026 | EXAMPLE: the example quarter end. |
| Progression: reporting rate at least | 20% | AW-11: over a group's last 2 campaigns at its grade. EXAMPLE value. |
| Progression: click rate at most | 15% | AW-11. EXAMPLE value. |
| Smallest group shown | 10 | AW-13: no result for a group smaller than this. |
| Simulation window (working days) | 5 | How long a simulation stays open for reports and clicks. |
This month at a glance
| Status or zone | Measures |
|---|---|
| Green: consistent with the risk within appetite | 0 |
| Amber: the risk may be above appetite | 1 |
| Red: the risk may be past tolerance | 0 |
| On target | 2 |
| Below target, within tolerance | 4 |
| Outside tolerance | 0 |
| No target set | 0 |
| Not available | 0 |
Measures short of target or out of green: 5. Commentary still needed: 0.
The measures
| Measure | Owned by | Target or thresholds | This month | Compared with the last period | Status or zone | Owner's commentary |
|---|---|---|---|---|---|---|
| HRM-01 Simulation reporting rate | P16 | [[40%]] at the group's current grade | 28% (124 of 441) at Grade 2 | Not comparable with 26% at Grade 1 last month (AW-15) | Below target, within tolerance | Not comparable with August's 26%, at Grade 1 (a change of grade is a break in series, AW-15). The same people reported 22% in July at Grade 1, and more at the harder grade in September. |
| HRM-02 Time to first report | P16 | [[10]] minutes or less at the group's current grade | 4 minutes at Grade 2 | Not comparable with 6 minutes at Grade 1 last month (AW-15) | On target | The first report came in 9, 6 and 4 minutes across the quarter's three campaigns. Not compared with August: the grade changed (AW-15). |
| HRM-03 Repeat clickers | P16 | [[2%]] or fewer | 2.5% (11 of 436) | No previous value | Below target, within tolerance | All 11 were offered coaching on 28 Sep 2026, within the 10 working days; 8 accepted and 3 sessions have been held. Nobody has reached the third stage. |
| HRM-04 Incidents with a human factor | P16 | [[2]] or fewer a quarter | 3 of 5 incidents this quarter | No previous value | Below target, within tolerance | Staff stopped or first reported 2 of the 5: INC-2026-015 and INC-2026-016. |
| HRM-05 Role training done by its due date | P16 | All | 4 of 4 | No previous value | On target | Three Tier 0 administrators before 21 Sep 2026, and J-04 within the induction window. LM-08 falls due for four more privileged users on 19 Oct 2026. |
| MC-36 Staff security training completion | P11, imported unchanged (MR-04) | [[95%]] | 92% | No previous value | Below target, within tolerance | Warehouse shift staff completed the short course on the floor terminals. The staff still to complete work night shifts: run the course on each warehouse night shift, HR Learning Lead, by 30 Nov 2026, to reach 95%. Not comparable with the June figure: the definition changed on 26 Jun 2026 (MR-09). |
| MC-34 Phishing compromises | P11, imported unchanged (MR-04) | Amber at 2, red at 4 incidents in 3 months | 2 in 3 months (INC-2026-014, INC-2026-017) | Worse (was 1, last month) | Amber: the risk may be above appetite | 2 in 3 months (INC-2026-014, INC-2026-017): amber, escalated to the owner of R-09 under P11 MR-08 once validated. The fix is the move to an authenticator app; the sign-in codes and prompts theme moved to February to follow it (PC-2). |
Status: On target; Below target, within tolerance; Outside tolerance; No target set. Zone (MC-34): Green: consistent with the risk within appetite; Amber: the risk may be above appetite; Red: the risk may be past tolerance. Simulation figures are compared only at the same grade (AW-15).
Incidents this quarter, by human factor (HRM-04)
| Human factor | Incidents |
|---|---|
| Opened a malicious attachment or link | 1 |
| Gave away a password or code | 1 |
| Sent data to the wrong person | 1 |
| Did not follow a procedure | 0 |
| Stopped or first reported by staff | 2 |
What happened, never who. The control that should have stopped each one is on the Human Factors sheet, and fixing it comes first (AW-02).
Context: suspicious emails staff reported (not a measure)
| Month | Reported by staff | Of which real phishing |
|---|---|---|
| 31 Jul 2026 | 41 | 9 |
| 31 Aug 2026 | 57 | 12 |
| 30 Sep 2026 | 83 | 16 |
EXAMPLE: the reporting habit carrying over to real mail. Thank every report (AW-08).
Non-working days (public holidays)
| Date | Holiday |
|---|
[[e.g. a public holiday]]
Measure Settings
One row per measure. Yellow columns are yours; the rest calculate for the report month on the Dashboard. MC-36 and MC-34 are the metrics pack's, unchanged (P11 MR-04).
| Row | Measure ID | Measure (calc) | Owned by (calc) | Type (calc) | Unit | Better when | Target | Tolerance limit | Amber at | Red at | Target or thresholds in words | Source (calc) | Campaign row (calc) | Previous campaign row (calc) | Values row (calc) | Previous values row (calc) | This period (calc) | Previous period (calc) | Grade now (calc) | Grade before (calc) | Value in words (calc) | Comparison (calc) | Status or zone (calc) | Commentary (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | HRM-01 | Simulation reporting rate | P16 | KPI | Share | Higher | 0.400 | 0.200 | [[40%]] at the group's current grade | Campaigns | 3 | 2 | 3 | 0.281 | 0.260 | 2 | 1 | 28% (124 of 441) at Grade 2 | Not comparable with 26% at Grade 1 last month (AW-15) | Below target, within tolerance | Not comparable with August's 26%, at Grade 1 (a change of grade is a break in series, AW-15). The same people reported 22% in July at Grade 1, and more at the harder grade in September. | OK | |||
| EXAMPLE | HRM-02 | Time to first report | P16 | KPI | Minutes | Lower | 10.000 | 30.000 | [[10]] minutes or less at the group's current grade | Campaigns | 3 | 2 | 4 | 4.000 | 6.000 | 2 | 1 | 4 minutes at Grade 2 | Not comparable with 6 minutes at Grade 1 last month (AW-15) | On target | The first report came in 9, 6 and 4 minutes across the quarter's three campaigns. Not compared with August: the grade changed (AW-15). | OK | |||
| EXAMPLE | HRM-03 | Repeat clickers | P16 | KPI | Share | Lower | 0.020 | 0.050 | [[2%]] or fewer | Monthly Values | 5 | 0.025 | 2.5% (11 of 436) | No previous value | Below target, within tolerance | All 11 were offered coaching on 28 Sep 2026, within the 10 working days; 8 accepted and 3 sessions have been held. Nobody has reached the third stage. | OK | ||||||||
| EXAMPLE | HRM-04 | Incidents with a human factor | P16 | KPI | Count | Lower | 2.000 | 3.000 | [[2]] or fewer a quarter | Human Factors | 6 | 3.000 | 3 of 5 incidents this quarter | No previous value | Below target, within tolerance | Staff stopped or first reported 2 of the 5: INC-2026-015 and INC-2026-016. | OK | ||||||||
| EXAMPLE | HRM-05 | Role training done by its due date | P16 | KPI | Share | Higher | 1.000 | 0.900 | All | Monthly Values | 7 | 1.000 | 4 of 4 | No previous value | On target | Three Tier 0 administrators before 21 Sep 2026, and J-04 within the induction window. LM-08 falls due for four more privileged users on 19 Oct 2026. | OK | ||||||||
| EXAMPLE | MC-36 | Staff security training completion | P11, imported unchanged (MR-04) | KPI | Share | Higher | 0.950 | 0.850 | [[95%]] | Monthly Values | 8 | 0.920 | 92% | No previous value | Below target, within tolerance | Warehouse shift staff completed the short course on the floor terminals. The staff still to complete work night shifts: run the course on each warehouse night shift, HR Learning Lead, by 30 Nov 2026, to reach 95%. Not comparable with the June figure: the definition changed on 26 Jun 2026 (MR-09). | OK | ||||||||
| EXAMPLE | MC-34 | Phishing compromises | P11, imported unchanged (MR-04) | KRI | Count | Lower | 2 | 4 | Amber at 2, red at 4 incidents in 3 months | Monthly Values | 9 | 2 | 2.000 | 1.000 | 2 in 3 months (INC-2026-014, INC-2026-017) | Worse (was 1, last month) | Amber: the risk may be above appetite | 2 in 3 months (INC-2026-014, INC-2026-017): amber, escalated to the owner of R-09 under P11 MR-08 once validated. The fix is the move to an authenticator app; the sign-in codes and prompts theme moved to February to follow it (PC-2). | OK |
Monthly Values
One row per measure per month. Values for HRM-03, HRM-05, MC-36, MC-34; commentary for every measure, including HRM-01, HRM-02, HRM-04, whose values are calculated on the Campaigns and Human Factors sheets.
| Row | Month end | Measure ID | Measure (calc) | Value | Out of (for a share) | Value in words | Break in series | Owner's commentary | Key (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | 31 Jul 2026 | MC-34 | Phishing compromises | 0 | 0 in 3 months | MC-34|46234 | OK | |||
| EXAMPLE | 31 Aug 2026 | MC-34 | Phishing compromises | 1 | 1 in 3 months | MC-34|46265 | OK | |||
| EXAMPLE | 30 Sep 2026 | HRM-01 | Simulation reporting rate | Not comparable with August's 26%, at Grade 1 (a change of grade is a break in series, AW-15). The same people reported 22% in July at Grade 1, and more at the harder grade in September. | HRM-01|46295 | OK | ||||
| EXAMPLE | 30 Sep 2026 | HRM-02 | Time to first report | The first report came in 9, 6 and 4 minutes across the quarter's three campaigns. Not compared with August: the grade changed (AW-15). | HRM-02|46295 | OK | ||||
| EXAMPLE | 30 Sep 2026 | HRM-03 | Repeat clickers | 11 | 436 | 2.5% (11 of 436) | All 11 were offered coaching on 28 Sep 2026, within the 10 working days; 8 accepted and 3 sessions have been held. Nobody has reached the third stage. | HRM-03|46295 | OK | |
| EXAMPLE | 30 Sep 2026 | HRM-04 | Incidents with a human factor | Staff stopped or first reported 2 of the 5: INC-2026-015 and INC-2026-016. | HRM-04|46295 | OK | ||||
| EXAMPLE | 30 Sep 2026 | HRM-05 | Role training done by its due date | 4 | 4 | 4 of 4 | Three Tier 0 administrators before 21 Sep 2026, and J-04 within the induction window. LM-08 falls due for four more privileged users on 19 Oct 2026. | HRM-05|46295 | OK | |
| EXAMPLE | 30 Sep 2026 | MC-36 | Staff security training completion | 828 | 900 | 92% | Warehouse shift staff completed the short course on the floor terminals. The staff still to complete work night shifts: run the course on each warehouse night shift, HR Learning Lead, by 30 Nov 2026, to reach 95%. Not comparable with the June figure: the definition changed on 26 Jun 2026 (MR-09). | MC-36|46295 | OK | |
| EXAMPLE | 30 Sep 2026 | MC-34 | Phishing compromises | 2 | 2 in 3 months (INC-2026-014, INC-2026-017) | 2 in 3 months (INC-2026-014, INC-2026-017): amber, escalated to the owner of R-09 under P11 MR-08 once validated. The fix is the move to an authenticator app; the sign-in codes and prompts theme moved to February to follow it (PC-2). | MC-34|46295 | OK |
Campaigns
One row per simulation campaign, one a month, entered when its window closes. Counts from the platform; no names (AW-13). The grade the progression rule gives: a group moves up when its last 2 campaigns at its grade reach the thresholds on the Dashboard (AW-11).
| Row | Campaign ID | Sent | Group | Grade | Theme | Recipients | Reported | Clicked | Entered a credential | First report (minutes) | Window closes (calc) | Month (calc) | Reporting rate (calc) | Click rate (calc) | Credential rate (calc) | Grade the rule gives (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | SIM-2026-07 | 14 Jul 2026 | Group A | 1 | CA-01 | 444 | 98 | 63 | 18 | 9 | 21 Jul 2026 | 31 Jul 2026 | 22% | 14% | 4% | 1 | OK |
| EXAMPLE | SIM-2026-08 | 25 Aug 2026 | Group B | 1 | CA-02 | 446 | 116 | 54 | 14 | 6 | 1 Sep 2026 | 31 Aug 2026 | 26% | 12% | 3% | 1 | OK |
| EXAMPLE | SIM-2026-09 | 17 Sep 2026 | Group A | 2 | CA-07 | 441 | 124 | 58 | 17 | 4 | 24 Sep 2026 | 30 Sep 2026 | 28% | 13% | 4% | 2 | OK |
Human Factors
One row per incident in the case log (P09), judged for a human factor from its root cause: what happened, never who, with the control that should have stopped it.
| Row | Incident ID | Detected | Severity declared | Severity final | Human factor | What happened (never who) | Control that should have stopped it | Stopped or first reported by staff | This quarter (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | INC-2026-014 | 12 Aug 2026 | 1 | 1 | Opened a malicious attachment or link | A warehouse office user opened a phishing attachment. | The account had local administrator rights (P09 PIA-01, P14 PA-03), and the site's office network was not yet separated (P05 TA-04). | No | Yes | OK |
| EXAMPLE | INC-2026-015 | 2 Sep 2026 | 3 | 3 | None | The accounts payable clerk called the supplier back on the number on file and stopped the change. | The call-back worked as designed (P05 TA-02). | Yes | Yes | OK |
| EXAMPLE | INC-2026-016 | 9 Sep 2026 | 2 | 2 | Sent data to the wrong person | A customer service agent sent a customer spreadsheet to the wrong business customer, and reported it at once. | Address autocomplete and no warning for external recipients (P09 PIA-06). | Yes | Yes | OK |
| EXAMPLE | INC-2026-017 | 22 Sep 2026 | 2 | 3 | Gave away a password or code | A sales administrator entered a password and a text-message code into a fake sign-in page. | Second factors by text message can be phished (P12 GAP-06; P14 does not accept them for privileged access). | No | Yes | OK |
| EXAMPLE | INC-2026-018 | 29 Sep 2026 | 4 | 4 | None | None: an internet-wide campaign against a published weakness. | The patch was already applied. | No | Yes | OK |
Lists
| MeasureID | MeasureName | MeasureOwner | MeasureType | MeasureTarget | Unit | Better | Factor | YesNo | Grade | ThemeID |
|---|---|---|---|---|---|---|---|---|---|---|
| HRM-01 | Simulation reporting rate | P16 | KPI | [[40%]] at the group's current grade | Share | Higher | Opened a malicious attachment or link | Yes | 1 | CA-01 |
| HRM-02 | Time to first report | P16 | KPI | [[10]] minutes or less at the group's current grade | Minutes | Lower | Gave away a password or code | No | 2 | CA-02 |
| HRM-03 | Repeat clickers | P16 | KPI | [[2%]] or fewer | Count | Sent data to the wrong person | 3 | CA-03 | ||
| HRM-04 | Incidents with a human factor | P16 | KPI | [[2]] or fewer a quarter | Did not follow a procedure | 4 | CA-04 | |||
| HRM-05 | Role training done by its due date | P16 | KPI | All | None | CA-05 | ||||
| MC-36 | Staff security training completion | P11, imported unchanged (MR-04) | KPI | [[95%]] | CA-06 | |||||
| MC-34 | Phishing compromises | P11, imported unchanged (MR-04) | KRI | Thresholds on Measure Settings | CA-07 |
CA-08
CA-09
CA-10
CA-11
CA-12
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| HRM-01 Simulation reporting rate | People who reported the month's simulation through the reporting route within the campaign window, out of the people it was sent to, shown with its grade. |
| HRM-02 Time to first report | Minutes from the month's simulation being sent to the first report of it through the reporting route, shown with its grade. |
| HRM-03 Repeat clickers | People who clicked in two or more simulations in the last 12 months, out of the people sent two or more in that time. A group figure; never a list of names (AW-13). |
| HRM-04 Incidents with a human factor | Incidents in the quarter whose root cause in the case log includes a person's action or omission (P09), shown beside the incidents that a member of staff stopped or first reported. |
| HRM-05 Role training done by its due date | Role modules that fell due in the period and were completed by their due date (AW-06, AW-07), out of all that fell due. |
| MC-36 Staff security training completion | Staff in post at the period end who have completed the security training due for their role in the last 12 months, as a share of all staff in post. Defined by the metrics pack (P11), used unchanged. |
| MC-34 Phishing compromises | Incidents in the last 3 calendar months whose root cause was a phishing email: an account taken over, or malware run from an attachment or link. Counted from the incident case log by the date detected. Defined by the metrics pack (P11), used unchanged. |
| Reported | The person used the reporting route for the simulated email. This is the behaviour the programme exists to build. |
| Clicked | The person opened the link or attachment in a simulated email. Opening the email alone is not recorded. |
| Entered a credential | The person typed something into the simulated sign-in page. What they typed is never stored. |
| Reporting rate | People who reported a simulation, out of the people it was sent to. |
| Time to first report | The minutes from a simulation being sent to the first report of it. It shows how soon a real attack would be known. |
| Repeat clicker | Someone who clicked in two or more simulations within 12 months. |
| Grade | How hard a simulation is to spot, from Grade 1 (many cues) to Grade 4 (one cue, tailored to a role). |
| Campaign measure 1: reporting rate | The behaviour the programme exists to build: a reported attack can be stopped for everyone. |
| Campaign measure 2: time to first report | How soon a real attack would be known. |
| Campaign measure 3: click rate | Context only: it moves with the grade and the lure, and a falling click rate with no reporting is not success. |
| Campaign measure 4: credentials entered | The worst outcome of a click: the share of clicks that would have given an account away. |
| Human factor | A person's action or omission that was one of an incident's causes in the case log's root cause, recorded as what happened, never as who. |
| Group result | A simulation result for a group of at least the minimum size, with no name in it. |
| Status: On target | At or better than the target. |
| Status: Below target, within tolerance | Short of the target, inside the tolerance limit. The owner's commentary gives the plan and the date. |
| Status: Outside tolerance | Beyond the tolerance limit. The owner's commentary says what is decided. |
| Not available | No value for the period: no campaign that month, or nothing entered. Last month's value is never carried forward. |
| Zone: Green | Green: consistent with the risk within appetite. The indicator is where the risk owner expects it while the linked risk is within appetite. |
| Zone: Amber | Amber: the risk may be above appetite. The indicator is at a level at which the linked risk may have moved above appetite. The risk owner reviews it. |
| Zone: Red | Red: the risk may be past tolerance. The indicator is at a level at which the linked risk may have moved past tolerance. Executive management is told and the risk is reassessed. |
| Compared with the last period | Better, Same or Worse than last month (last quarter for HRM-04), with that figure; Not comparable when the grade changed (AW-15) or the series broke (P11 MR-09); No previous value when there is none. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | The dashboard as a whole: what is measured about people's behaviour, when, and how the results are evaluated each month |
| ISO/IEC 27001:2022 | Annex A 6.3 — Information security awareness, education and training | Campaigns and HRM-05: whether awareness and training change what people do |
| NIST CSF 2.0 | GV.OV-03 — “Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed” | Status, comparison and commentary: the awareness programme's performance evaluated and reviewed each month |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training” | The dashboard as a whole: whether cybersecurity training as a risk-management measure works |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Whom the Implementing Regulation binds: for other entities it shows what a supervisor expects |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 8.1.3 — “The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The awareness raising programme shall be updated and offered at planned intervals taking into account changes in cyber hygiene practices, and the current threat landscape and risks posed to the relevant entities.” | HRM-01 to HRM-04: the awareness programme tested for effectiveness |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 8.2.3 — “The training referred to in point 8.2.1 shall be relevant to the job function of the employee and its effectiveness shall be assessed.” It covers “(a) instructions regarding the secure configuration and operation of the network and information systems, including mobile devices; (b) briefing on known cyber threats; (c) training of the behaviour when security-relevant events occur.” | HRM-05: role training whose effectiveness is assessed |
| DORA — Regulation (EU) 2022/2554 | Article 13(6) — “Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i).” | Tailoring for financial entities: evidence that the compulsory awareness programme reaches and changes staff behaviour |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.