Are you ready to TAMAM your cybersecurity awareness?

And who do you want to reach exactly? That is your audience, your population, your people that need awareness, training, and education. A clear identification of these specific audiences will help you define an approach that is meant to reach them. To know these needs you will need to start by differentiating people in clusters – mostly based on their positions in the organization, their closeness to the topic, their expositions to the risks you want to prevent, their role figures, etc. These clusters can gather newcomers, external staff, local ambassadors, IT staff, etc.

For each of these populations, you will want to assess their current level of mastery of the different targets defined. That is basically performing a skills gap to know what topics requires more attention for each population. This information will be essential to customize the program to the needs of these populations (because you understand what they do in life) and their current level of mastery (which you have assessed precisely).

Off we go now with the messages you want to communicate to these people to reach these objectives; the moment where you find this catchy phrase that will be repeated oftentimes. The people with whom you will be communicating also receive numerous other communications for numerous other causes (name it: CSR, compliance, values, etc.). Hence the importance to select your messages wisely and to stay concise. The time and attention available are limited, this is why you will prefer to select a few messages that address key risks and meaningful objectives.

Eventually, the tone used to communicate these messages is crucial as it must be adapted to the organizational culture: funny messages work in some environment while serious ones work better in others. Regardless of the tone used, the messages will need to be positive and call for action. Drop out the negative injunctions (“don’t”) and embrace the positive actions (“act”).

With these first three steps in mind (Target, Audience and Message), you build up the framing of your cyberawareness program: you know what you want to tell, to whom, in order to reach the expected behaviors.

Now that you have tailored your messages for your specific audiences to reach the defined objectives, time has come to identify the actions that you will implement in this framing. Although you now open the catalogue of action, you must be focus and pragmatic. The principle when doing so is to think of the effectiveness of the chosen action in your journey to reach your objectives. Creativity and innovation are surely important to keep people motivated but is not the sole success factor. You want to make cybersecurity practical for people, to bring the topic closer to their life and to involve them in their learning (e.g., practical activities, application of the behavior expected, etc.) on top of a more theoretical top-down approach.

The way you implement these activities is also an essential success factor, with the right resources, people and planning to enforce the selected messages:

• Who is the bearer of these messages? Internal or external?
• How to repeat them in different ways (as different people will respond to different stimuli that can be practical, visual, spoken, etc.)
• From what angles and with what activities should these issues be addressed in order to raise awareness among employees in the most appropriate way?

With few selected messages, you build different activities, at different moments, with different approaches, to embed these behaviors in your audiences’ daily lives.

Finally, this whole program needs to be evaluated in order to say if it actually allows to change behaviors – for the management that will ask to see the value delivered for its investment, or for the awareness team that will want to show tangible results from its efforts.

In your quest to raise awareness, you must focus on the effectiveness of what you implement, beyond the implementation itself. All too frequently, organizations focus on numbers of activities or people addressed. But these figures seldom provide a real understanding of the change of behaviors happening.

When building your evaluation plan, you need to include quantitative measures and qualitative feedback to obtain a comprehensive understanding of the achievement of your objectives. Perhaps this will require new ways to gather this information – like getting the helpdesk involved, or even obtaining fresh data from the SOC – but the outcome will bring terrific value to your program as it will allow you to review it and keep it continuously adapted to your objectives; which can also be subject to adaptations if the organizational context changes.

Oh, and don’t forget one last thing if you want to create a positive trend in awareness: communicate your achievements and celebrate the victories with everyone. You deserve it.