{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/awareness-programme","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/awareness-programme/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/awareness-programme/"},"term":{"en":"Awareness programme","da":"Awareness-program"},"aka":{"en":["awareness program","awareness campaign","awareness plan"],"da":["awareness-kampagne","awarenessplan"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","summary":{"en":"A planned, ongoing effort to change how staff behave around security - with target groups, messages, methods and measurable goals.","da":"En planlagt og løbende indsats for at ændre medarbejdernes adfærd omkring sikkerhed - med målgrupper, budskaber, metoder og målbare mål."},"body":{"formal":{"en":"A structured plan for building security awareness across an organisation - defining the people involved, target groups and messages, choosing methods such as online courses, workshops, phishing simulations and nudges, and tracking results with agreed measures.","da":"En struktureret plan for at opbygge awareness i hele organisationen - med interessenter, målgrupper og budskaber, valg af metoder som e-læring, workshops, phishing-simuleringer og nudges, og opfølgning på resultater med aftalte mål."},"plain":{"en":"Like a fitness plan rather than a single gym visit - small, regular sessions matched to each person, with progress checked along the way.","da":"Som en træningsplan frem for et enkelt besøg i fitnesscentret - små, faste pas tilpasset den enkelte, hvor fremskridtet tjekkes undervejs."},"inPractice":{"en":"A municipality plans a year of short monthly topics, a phishing test each quarter and a separate session for managers, and each quarter tells the management team what share of staff report suspicious emails.","da":"En kommune planlægger et år med korte månedlige temaer, en phishing-test hvert kvartal og en særskilt session for ledere, og hvert kvartal orienterer den direktionen om, hvor stor en andel af medarbejderne der melder mistænkelige mails."},"whyItMatters":{"en":"One talk a year changes little; lasting change in behaviour needs repetition, relevance and measurement, and NIS2 expects training to be part of the security work.","da":"Ét foredrag om året ændrer ikke meget; varig adfærdsændring kræver gentagelse, relevans og måling, og NIS2 forventer, at træning er en del af sikkerhedsarbejdet."}},"deepDive":{"en":"NIST SP 800-50 Rev. 1 (September 2024) models the programme as a four-phase life cycle, one section each: Plan and Strategy (Section 2), Analysis and Design (Section 3), Development and Implementation (Section 4), and Assessment and Improvement (Section 5). The phases may run in sequence or in parallel, and the model is explicitly iterative, so a new threat, an incident or a regulatory change can re-enter the cycle at any point. Inside Section 3 NIST applies the classic ADDIE instructional-design model (Analysis, Design, Development, Implementation, Evaluation): identify learning needs from work-role tasks, define audiences, map needs to audiences, assess current knowledge and determine the gaps before any content is written.\n\nSection 2.7 distinguishes three element types: awareness activities (logon banners, newsletters, posters, timely emails, campaign months) that reach everyone continuously; experiential learning such as phishing, smishing and vishing simulations, tabletop exercises and cyber-range scenarios; and training, which builds skills for roles with significant security or privacy responsibilities. Awareness changes attention, training changes competence; a programme that only has the former cannot fix skill gaps among developers or administrators, and one that only has the latter leaves the general workforce untouched.\n\nDesign choices that matter in practice are segmentation by risk exposure rather than by org chart (payment approvers, HR, privileged admins and executives face different pretexts), spacing and repetition instead of one annual block, and just-in-time delivery at the point of decision, where nudges complement formal learning. CIS Controls v8 Control 14 turns this into auditable safeguards, starting with establishing and maintaining the programme, training on social engineering, authentication and data handling, and adding role-specific training.\n\nMeasurement is where many programmes fail. Section 2.4 of SP 800-50r1 distinguishes activity metrics (attendance, cost per participant) from behaviour-change metrics such as the share of participants who report a simulated phishing email. Mature programmes track reporting rate, time-to-report, repeat-clicker trends and incidents with a human root cause, and treat click rates with caution because they depend heavily on how hard the template is. Field studies at UC San Diego Health (IEEE S&P 2025) and in a large organisation with more than 14,000 employees (IEEE S&P 2022) found little or no protective effect from annual training and embedded post-click lessons, which argues for pairing the programme with technical controls such as phishing-resistant MFA rather than expecting training alone to carry the risk. On the compliance side the programme is the evidence for ISO/IEC 27001:2022 clause 7.3 and Annex A 6.3, NIS2 Art. 21(2)(g) and, for financial entities, DORA Art. 13(6).","da":"NIST SP 800-50 Rev. 1 (september 2024) beskriver programmet som en livscyklus i fire faser med ét afsnit til hver: Plan and Strategy (afsnit 2), Analysis and Design (afsnit 3), Development and Implementation (afsnit 4) og Assessment and Improvement (afsnit 5). Faserne kan forløbe efter hinanden eller samtidig, og modellen er udtrykkeligt iterativ, så en ny trussel, en hændelse eller et nyt lovkrav kan sende programmet tilbage i cyklussen når som helst. I afsnit 3 bruger NIST den klassiske ADDIE-model for undervisningsdesign (Analysis, Design, Development, Implementation, Evaluation): Læringsbehov udledes af rollernes opgaver, målgrupperne defineres, behov kobles til målgrupper, nuværende viden vurderes, og hullerne fastlægges, før der skrives en eneste linje indhold.\n\nAfsnit 2.7 skelner mellem tre typer elementer: awareness-aktiviteter (loginbannere, nyhedsbreve, plakater, rettidige mails, temamåneder), der løbende når alle; erfaringsbaseret læring som phishing-, smishing- og vishing-simuleringer, tabletop-øvelser og scenarier i cyber ranges; og egentlig træning, der opbygger færdigheder hos roller med væsentligt sikkerheds- eller privatlivsansvar. Awareness ændrer opmærksomhed, træning ændrer kompetence; et program med kun det første kan ikke lukke kompetencehuller hos udviklere eller administratorer, og et program med kun det sidste lader den brede medarbejderstab være urørt.\n\nDe designvalg, der betyder noget i praksis, er segmentering efter risikoeksponering frem for organisationsdiagram (betalingsgodkendere, HR, privilegerede administratorer og direktionen møder forskellige påskud), spredte gentagelser frem for én årlig blok og levering lige dér, hvor beslutningen træffes, hvor nudges supplerer den formelle læring. CIS Controls v8 Control 14 omsætter det til reviderbare safeguards, der starter med at etablere og vedligeholde programmet, træne i social engineering, autentificering og datahåndtering og tilføje rollespecifik træning.\n\nMåling er dér, mange programmer fejler. Afsnit 2.4 i SP 800-50r1 skelner mellem aktivitetsmål (fremmøde, pris pr. deltager) og mål for adfærdsændring, fx andelen af deltagere, der melder en simuleret phishing-mail. Modne programmer følger meldeprocent, tid til melding, udviklingen i gengangere, der klikker igen, og hændelser med menneskelig grundårsag, og de behandler klikrater varsomt, fordi de afhænger stærkt af, hvor svær skabelonen er. Feltstudier på UC San Diego Health (IEEE S&P 2025) og i en stor organisation med over 14.000 ansatte (IEEE S&P 2022) fandt kun lille eller ingen beskyttende effekt af årlig træning og indlejrede lektioner efter et klik, hvilket taler for at koble programmet med tekniske kontroller som phishing-resistent MFA i stedet for at forvente, at træning alene bærer risikoen. På compliance-siden er programmet dokumentationen for ISO/IEC 27001:2022 pkt. 7.3 og bilag A 6.3, NIS2 art. 21, stk. 2, litra g, og for finansielle virksomheder DORA-forordningens art. 13, stk. 6."},"edges":[{"type":"requires","to":"security/security-awareness","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/human-error","why":{"en":"Regular, practical training makes common mistakes less likely and faster to report.","da":"Løbende, praktisk træning gør almindelige fejl mindre sandsynlige og hurtigere at melde."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/nudging","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-metrics","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 2","tier":"course-material"},{"title":"NIST SP 800-50 Rev. 1 - Building a Cybersecurity and Privacy Learning Program","tier":"standard"},{"title":"Ho et al. - Understanding the Efficacy of Phishing Training in Practice (IEEE S&P 2025)","url":"https://people.cs.uchicago.edu/~grantho/papers/oakland2025_phishing-training.pdf","tier":"other","publisher":"IEEE"}],"draft":true}