Awareness programme

NIST SP 800-50 Rev. 1 (September 2024) models the programme as a four-phase life cycle, one section each: Plan and Strategy (Section 2), Analysis and Design (Section 3), Development and Implementation (Section 4), and Assessment and Improvement (Section 5). The phases may run in sequence or in parallel, and the model is explicitly iterative, so a new threat, an incident or a regulatory change can re-enter the cycle at any point. Inside Section 3 NIST applies the classic ADDIE instructional-design model (Analysis, Design, Development, Implementation, Evaluation): identify learning needs from work-role tasks, define audiences, map needs to audiences, assess current knowledge and determine the gaps before any content is written.

Section 2.7 distinguishes three element types: awareness activities (logon banners, newsletters, posters, timely emails, campaign months) that reach everyone continuously; experiential learning such as phishing, smishing and vishing simulations, tabletop exercises and cyber-range scenarios; and training, which builds skills for roles with significant security or privacy responsibilities. Awareness changes attention, training changes competence; a programme that only has the former cannot fix skill gaps among developers or administrators, and one that only has the latter leaves the general workforce untouched.

Design choices that matter in practice are segmentation by risk exposure rather than by org chart (payment approvers, HR, privileged admins and executives face different pretexts), spacing and repetition instead of one annual block, and just-in-time delivery at the point of decision, where nudges complement formal learning. CIS Controls v8 Control 14 turns this into auditable safeguards, starting with establishing and maintaining the programme, training on social engineering, authentication and data handling, and adding role-specific training.

Measurement is where many programmes fail. Section 2.4 of SP 800-50r1 distinguishes activity metrics (attendance, cost per participant) from behaviour-change metrics such as the share of participants who report a simulated phishing email. Mature programmes track reporting rate, time-to-report, repeat-clicker trends and incidents with a human root cause, and treat click rates with caution because they depend heavily on how hard the template is. Field studies at UC San Diego Health (IEEE S&P 2025) and in a large organisation with more than 14,000 employees (IEEE S&P 2022) found little or no protective effect from annual training and embedded post-click lessons, which argues for pairing the programme with technical controls such as phishing-resistant MFA rather than expecting training alone to carry the risk. On the compliance side the programme is the evidence for ISO/IEC 27001:2022 clause 7.3 and Annex A 6.3, NIS2 Art. 21(2)(g) and, for financial entities, DORA Art. 13(6).