{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/awareness-maturity","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/awareness-maturity/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/awareness-maturity/"},"term":{"en":"Awareness maturity","da":"Awareness-modenhed"},"aka":{"en":["security awareness maturity"],"da":["awareness maturity"]},"domain":["security"],"cluster":"awareness","layer":"governance","status":"current","summary":{"en":"A measure of how far an organisation has come in making security part of how its people think and act.","da":"Et mål for, hvor langt en organisation er nået med at gøre sikkerhed til en del af, hvordan dens folk tænker og handler."},"body":{"formal":{"en":"An assessment that places an organisation's awareness work on a scale of stages - from nothing in place, through a yearly course held only to meet requirements, to lasting change in behaviour and security culture - to show where it stands and what to improve next.","da":"En vurdering, der placerer organisationens awareness-arbejde på en skala med trin - fra intet på plads over et kursus en gang om året for at opfylde kravene til varig ændring i adfærd og sikkerhedskultur - så det bliver tydeligt, hvor den står, og hvad der skal forbedres som det næste."},"plain":{"en":"Like the swimming badges children earn in stages - a badge does not make them swim better, but it shows honestly where they are and what the next step is.","da":"Som svømmemærker for børn - mærket gør dem ikke bedre til at svømme, men det viser ærligt, hvor de står, og hvad næste skridt er."},"inPractice":{"en":"The awareness lead at a pension fund places it at the stage “one course a year, nothing measured”, and sets the goal of tracking phishing reports every quarter to reach the next stage.","da":"Den awareness-ansvarlige i en pensionskasse placerer den på trinnet “ét kursus om året, ingen målinger” og sætter som mål at følge antallet af phishing-meldinger hvert kvartal for at nå næste trin."},"whyItMatters":{"en":"Without a measure, awareness work is judged by how much training was held rather than whether behaviour changed, and leaders cannot see progress or decide where to spend.","da":"Uden et mål bliver awareness-arbejdet vurderet på, hvor meget træning der blev holdt, frem for om adfærden ændrede sig, og ledelsen kan hverken se fremskridt eller vælge, hvor pengene skal bruges."}},"deepDive":{"en":"Awareness maturity models are staged capability models in the tradition of CMM/CMMI, applied to the human side of security. The most widely cited is the SANS Security Awareness Maturity Model, which defines five stages: Non-Existent; Compliance Focused, where the goal is to satisfy an audit or regulatory training requirement, typically with an annual module; Promoting Awareness and Behavior Change, where the programme targets a small set of high-impact human risks and addresses them continuously; Long-Term Culture Change; and a fifth stage, originally labelled Metrics Framework and in the current edition Optimization and Resilience, where outcomes are tied to measurable risk reduction. SANS itself puts measurable results from stage three at roughly six to twelve months, and stage four at three to ten years depending on size and complexity.\n\nNIST SP 800-50 Rev. 1 (September 2024) takes a different route: its Appendix A offers example maturity levels adapted from the FY21 Inspector General FISMA metrics - Ad Hoc, Defined, Consistently Implemented, Managed and Measurable, and Optimized - scored per question, for example whether roles are defined and resourced, whether workforce skills are assessed, and whether the programme's effectiveness is measured through practical exercises. At the top level the organisation must be able to show that incidents caused by personnel actions or inactions are decreasing over time, which moves the evidence from activity to outcome.\n\nThe key methodological point is that maturity describes the programme's capability, not the workforce's current risk level. A mature programme can still report a high click rate in a hard simulation, and an immature one can look good on a trivial template. Assessments should therefore combine document evidence (strategy, plan, roles, budget), process evidence (needs analysis, audience segmentation, repetition cadence) and outcome evidence (reporting rate, time-to-report, repeat-clicker trends, incidents with a human root cause). Completion percentages of mandatory e-learning are the classic stage-two metric and say almost nothing about behaviour.\n\nCommon failure modes are self-assessment inflation, scoring the average of many dimensions and hiding one weak dimension, and treating a level as an end state rather than a snapshot. In practice the score feeds a gap analysis against a target level chosen from the organisation's risk appetite, and the reassessment is repeated yearly as the Check step of a PDCA cycle. Awareness maturity is a sub-dimension of overall security maturity; it borrows the same scale logic as, for example, the implementation tiers in the NIST Cybersecurity Framework, but measures learning and behaviour rather than technical controls.","da":"Modenhedsmodeller for awareness er trinbaserede kapabilitetsmodeller i CMM/CMMI-traditionen, anvendt på sikkerhedens menneskelige side. Den mest citerede er SANS Security Awareness Maturity Model, der har fem trin: Non-Existent; Compliance Focused, hvor målet er at opfylde et revisions- eller lovkrav om træning, typisk med ét årligt modul; Promoting Awareness and Behavior Change, hvor programmet går målrettet efter nogle få menneskelige risici med stor effekt og arbejder med dem løbende; Long-Term Culture Change; og et femte trin, oprindeligt kaldet Metrics Framework og i den nuværende udgave Optimization and Resilience, hvor resultaterne kobles til målbar risikoreduktion. SANS angiver selv, at trin tre giver målbare resultater på cirka seks til tolv måneder, mens trin fire tager tre til ti år afhængigt af organisationens størrelse og kompleksitet.\n\nNIST SP 800-50 Rev. 1 (september 2024) går en anden vej: Appendix A giver eksempler på modenhedsniveauer, tilpasset fra de amerikanske Inspector General FISMA-metrikker for FY21 - Ad Hoc, Defined, Consistently Implemented, Managed and Measurable og Optimized - der vurderes spørgsmål for spørgsmål, fx om roller er defineret og har ressourcer, om medarbejdernes kompetencer vurderes, og om programmets effekt måles med praktiske øvelser. På øverste niveau skal organisationen kunne dokumentere, at hændelser forårsaget af medarbejderes handlinger eller undladelser falder over tid, så beviserne flytter sig fra aktivitet til effekt.\n\nDen vigtigste metodiske pointe er, at modenhed beskriver programmets kapabilitet, ikke medarbejdernes aktuelle risikoniveau. Et modent program kan sagtens vise en høj klikrate i en svær simulering, og et umodent program kan se godt ud på en let skabelon. En vurdering bør derfor kombinere dokumentation (strategi, plan, roller, budget), procesbevis (behovsanalyse, segmentering af målgrupper, gentagelsesfrekvens) og effektmål (meldeprocent, tid til melding, udviklingen i gengangere, der klikker igen og igen, og hændelser med menneskelig grundårsag). Gennemførelsesprocenten for obligatorisk e-læring er det klassiske mål på trin to og siger næsten intet om adfærd.\n\nTypiske faldgruber er for optimistiske selvevalueringer, at man tager gennemsnittet af mange dimensioner og dermed skjuler en enkelt svag dimension, og at et niveau opfattes som en slutstation frem for et øjebliksbillede. I praksis bruges scoren som input til en gap-analyse mod et målniveau, der vælges ud fra organisationens risikovillighed, og vurderingen gentages årligt som Check-trinnet i en PDCA-cyklus. Awareness-modenhed er en delmængde af den samlede sikkerhedsmodenhed; den låner samme skalalogik som fx implementeringsniveauerne (tiers) i NIST Cybersecurity Framework, men måler læring og adfærd frem for tekniske kontroller."},"edges":[{"type":"requires","to":"security/security-awareness","confidence":"high","strength":"normal"},{"type":"requires","to":"security/security-culture","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/security-maturity","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/gap-analysis","why":{"en":"The maturity score shows where you are; the gap analysis spells out what separates it from where you want to be.","da":"Modenhedsscoren viser, hvor man står; gap-analysen beskriver, hvad der skiller det fra, hvor man vil hen."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"security/pdca","why":{"en":"Repeating the measurement each cycle is how the check step of continuous improvement is done for awareness.","da":"At gentage målingen hver runde er måden, check-trinnet i kontinuerlig forbedring udføres på for awareness."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"security/security-metrics","confidence":"high","strength":"normal"}],"depth":3,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"SANS Security Awareness Maturity Model","url":"https://www.sans.org/security-awareness-training/resources/maturity-model/","tier":"reference","publisher":"SANS Institute"},{"title":"NIST SP 800-50 Rev. 1 - Building a Cybersecurity and Privacy Learning Program (Appendix A, maturity levels)","url":"https://csrc.nist.gov/pubs/sp/800/50/r1/final","tier":"standard","publisher":"NIST"}],"draft":true}