Security Awareness, Workforce Culture, and Talent Management
Security Awareness, Workforce Culture, and Talent Management
This domain tests whether you treat people as a control environment rather than a compliance audience. Expect questions on behaviour change, phishing simulation design, culture measurement, insider risk, and building a sustainable security workforce.
Awareness that changes behaviour
- Completion rates prove attendance, not behaviour. Measure report rate, time-to-report, repeat click rate, and near-miss reporting instead.
- Role-based training: developers need secure coding and dependency hygiene; finance needs payment-change verification; executives need decision-making under incident pressure.
- Phishing simulations should be educational, not punitive. Public shaming of clickers suppresses reporting, which is the behaviour you most need.
Culture and insider risk
Culture surveys, psychological safety, and clear escalation channels reveal whether staff will report mistakes. An insider risk program balances monitoring with privacy and legal constraints, and distinguishes negligent from malicious behaviour.
Workforce and talent
Use a skills framework such as the NIST NICE Workforce Framework for Cybersecurity to map roles, identify gaps, and plan development. Retention depends on career paths, meaningful work, fair compensation, and manageable on-call load; burnout drives attrition and with it, control failures. Third-party staffing needs the same access governance as employees.
Worked example
A phishing program reports click rate falling from 12% to 4%, which leadership celebrates. The report rate also fell from 60% to 20%. Diagnosis: the new simulation shames clickers in a team scoreboard, so staff stopped reporting and started deleting suspicious mail silently. Remediation: remove the scoreboard, add a one-click report button, thank reporters publicly, and feed reports into triage so staff see outcomes. Reasoning: click rate in isolation is a vanity metric; reporting is the behaviour that shortens detection.
Traps that cost marks
- Reporting only completion percentages as program success.
- Punitive simulation design that suppresses reporting.
- Annual-only training with no reinforcement or role relevance.
- Ignoring insider risk because "we trust our people".
- Treating contractors and third-party staff as outside the awareness program.