How to Develop a Security Awareness Training Plan

Security awareness has become a higher priority for all businesses in the United States since the terrorist attacks on September 11, 2001. With a color-coded advisory system put in place by the Department of Homeland Security and frequent news alerts about possible attacks or attempts that were thwarted, many companies have initiated security awareness training. Setting up a training plan is a good idea for any business. Whether it be a terrorist attack, fire, natural disaster or loss prevention scenario, everyone benefits by having a plan in place that employees can follow in crisis. Some diligence is needed to put a plan in place.

Instructions

1. Analyze what your biggest security concerns are. Are you worried about your computer system being attacked by viruses or are you more concerned with employee response in the event of a tornado? Prioritize what your biggest concerns are so you can assemble a comprehensive plan to address those concerns. You will definitely want an evacuation procedure in emergencies and a method for all employees to anonymously report suspicious activity.

2. Assign roles. Decide which department heads or supervisors should be taught which information. Do you want all your supervisors to learn CPR and first aid training? A human resources supervisor would not need to be as concerned about industrial espionage as a loss prevention specialist would. Figure out how best to utilize your supervisory staff to put a policy in place and then train those supervisors so they can fulfill those duties.

3. Hire a security specialist. If you do not have someone on staff with the experience needed to implement new security protocols, hire someone who does. This can either be a permanent position to institute and follow through on new security measures, or a consultant can be brought in to recommend necessary procedures. He can assist with how best to deal with your concerns and assist in the transition of any new policies, such as monthly evacuation drills and on-going skills assessments.

4. Communicate with your staff. Send frequent emails reminding employees of any new programs or policies and have regular meetings to make sure there are no questions or concerns. Make yourself as accessible as possible to facilitate the introduction of any new plans.

References

• Gideon T. Rasmussen: Building a Security Awareness Program
• SANS Institute: Developing an Integrated Security Training, Awareness, and Education Program
• National Institute of Standards and Technology: Building an Information Technology Security Awareness and Training Program