Performance-based questions

Security awareness programme design

1. 1

   Response when an employee clicks a simulated phishing link

   • Formal disciplinary action
   • Immediate short training, no punishment
   • Publish a list of clickers to the department
2. 2

   Primary metric for programme effectiveness

   • Percentage completing the training module
   • Rate and speed of reporting suspicious messages
   • Number of simulated emails sent
3. 3

   Training cadence

   • One module at onboarding only
   • Initial at onboarding plus recurring refreshers
   • Only after an incident occurs
4. 4

   What staff should be told to do with a suspected phishing email

   • Delete it immediately
   • Report it through the designated channel
   • Forward it to colleagues as a warning
5. 5

   Content for a largely remote workforce

   • Data centre physical access procedures
   • Home network security and shoulder surfing in public
   • Firewall rule syntax
6. 6

   Behaviour to encourage staff to report about colleagues

   • Only deliberate malicious acts
   • Risky, unexpected and unintentional behaviour alike
   • Nothing; reporting colleagues damages morale