Security Awareness Program Assessment

Get started here!

Respond to the following questions and get your Security Awareness Program Score. When finished, use the button at the bottom of the page to generate your scorecard. (You may select more than one answer for each question.)

Feedback

Watch as your Security Awareness Program Score builds in real time across each step.

Step 1: Analyze

1. Which of the following are objectives of your security awareness program?

A. Analysis of user knowledge

B. Analysis of user behavior

C. Insight from risk assessments, audits and incident reports

D. Input from business stakeholders

E. Research of security industry reports and benchmarks

2. Which audience is included in your program?

A. Current employees

B. New hires

C. Temporary employees

D. Partners and suppliers

E. Clients

Step 2: Plan

3. Which departments contribute to planning your campaigns?

A. IT Security

B. Human Resources

C. Communications

D. IT Administration and Support

E. Legal and Privacy

4. How do you target your program campaigns?

A. General for all employees

B. Targeted based on function (ex. HR, IT)

C. Targeted based on technology (e.g. email use) or risk (e.g. handling PII)

D. Targeted for managers

E. Targeted for executives

Step 3: Deploy

5. What campaign activities are included in your program?

A. Interactive eLearning

B. Phishing Simulations

C. Social Engineering test

D. Communication with articles, blogs and videos

E. Reinforcement with posters, screensavers,wallpaper

6. What elements do you include in your security awareness content?

A. Corporate policies

B. Interactive games and exercises

C. Real life scenarios and public news stories

D. Procedures for reporting incidents

E. Just-in-time training

Step 4: Measure

7. What categories of program metrics do you collect?

A. Training participation

B. Knowledge retention (e.g. quiz or assessment)

C.User behavior (e.g. simulation tests, incident reports)

D. Repeat offenders

E. Content appreciation by audience

8. How do you follow up on program participation and user behavior?

A. Negative consequences for insecure behavior

B. Positive consequences for secure behavior

C. Just-in time feedback

D. Communicating insecure behaviors at large

E. Communicating secure behaviors at large

Step 5: Optimize

9. Who gets updates and reports on your program performance?

A. Program manager

B. Program sponsor

C. Executive Security Committee

D. Department leads

E. Program audience

10. What steps do you take to optimize your program?

A. Reviewing results and comparing against objectives

B. Optimizing at least annually

C. Adjusting based on stakeholder and user feedback

D. Evaluating the risk landscape impacting your organization

E. Considering changes to policies, laws and regulations

Hidden

fname

Hidden

lname