How to Build a Security Awareness Program

Return to the Cybersecurity Career Playbook

A learning program should reduce defined risks and improve useful behavior. Completion rates alone do not show safer work.

Analyze the Audience #

Group learners by task, access, risk, language, accessibility need, work location, and legal or labor constraints. Include contractors and leaders where the scope requires them.

Build an audience matrix:

Design the Program #

For each module, state one behavior, one practice task, one feedback method, and one follow-up decision. Keep policy, privacy, and reporting routes specific to the organization.

Phishing simulations need legal, privacy, labor, and accessibility review. Avoid public embarrassment, deceptive collection of real passwords, or punitive ranking. Give learners a safe reporting path and explain how data is used and retained.

Measure Behavior #

Useful measures include reporting rate, time to report, report quality, repeat error pattern, help requests, and completion of role tasks. Record false positives and context. A higher report count might reflect better reporting rather than more attacks.

Compare a baseline with later periods or a planned comparison group where appropriate. Do not claim one training event caused an outcome without a sound design.

Program Exercise #

Create a one-page plan for a fictional organization:

1. Three audiences
2. One risk and behavior for each
3. Accessible delivery options
4. One safe practice activity
5. Baseline and target
6. Privacy and retention rule
7. Review date and improvement decision

Pass condition: Each audience has a role-relevant behavior, practice task, evidence measure, support route, and decision triggered by the result.

References #

• NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program
• CISA Secure Our World

Link reporting behavior to the Incident Response Program .