{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/awareness-programme","url":{"en":"https://atlas.maintz.dev/en/terms/security/awareness-programme/","da":"https://atlas.maintz.dev/da/terms/security/awareness-programme/"},"term":{"en":"Awareness programme","da":"Awareness-program"},"aka":{"en":["awareness program","awareness campaign","awareness plan"],"da":["awareness-kampagne","awarenessplan"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","summary":{"en":"A planned, ongoing effort to change how staff behave around security - with target groups, messages, methods and measurable goals.","da":"En planlagt og løbende indsats for at ændre medarbejdernes adfærd omkring sikkerhed - med målgrupper, budskaber, metoder og målbare mål."},"body":{"formal":{"en":"A structured plan for building security awareness across an organisation - defining the people involved, target groups and messages, choosing methods such as online courses, workshops, phishing simulations and nudges, and tracking results with agreed measures.","da":"En struktureret plan for at opbygge awareness i hele organisationen - med interessenter, målgrupper og budskaber, valg af metoder som e-læring, workshops, phishing-simuleringer og nudges, og opfølgning på resultater med aftalte mål."},"plain":{"en":"Like a fitness plan rather than a single gym visit - small, regular sessions matched to each person, with progress checked along the way.","da":"Som en træningsplan frem for et enkelt besøg i fitnesscentret - små, faste pas tilpasset den enkelte, hvor fremskridtet tjekkes undervejs."},"inPractice":{"en":"A municipality plans a year of short monthly topics, a phishing test each quarter and a separate session for managers, and each quarter tells the management team what share of staff report suspicious emails.","da":"En kommune planlægger et år med korte månedlige temaer, en phishing-test hvert kvartal og en særskilt session for ledere, og hvert kvartal orienterer den direktionen om, hvor stor en andel af medarbejderne der melder mistænkelige mails."},"whyItMatters":{"en":"One talk a year changes little; lasting change in behaviour needs repetition, relevance and measurement, and NIS2 expects training to be part of the security work.","da":"Ét foredrag om året ændrer ikke meget; varig adfærdsændring kræver gentagelse, relevans og måling, og NIS2 forventer, at træning er en del af sikkerhedsarbejdet."}},"deepDive":{"en":"NIST SP 800-50 Rev. 1 (September 2024) models the programme as a four-phase life cycle, one section each: Plan and Strategy (Section 2), Analysis and Design (Section 3), Development and Implementation (Section 4), and Assessment and Improvement (Section 5). The phases may run in sequence or in parallel, and the model is explicitly iterative, so a new threat, an incident or a regulatory change can re-enter the cycle at any point. Inside Section 3 NIST applies the classic ADDIE instructional-design model (Analysis, Design, Development, Implementation, Evaluation): identify learning needs from work-role tasks, define audiences, map needs to audiences, assess current knowledge and determine the gaps before any content is written.\n\nSection 2.7 distinguishes three element types: awareness activities (logon banners, newsletters, posters, timely emails, campaign months) that reach everyone continuously; experiential learning such as phishing, smishing and vishing simulations, tabletop exercises and cyber-range scenarios; and training, which builds skills for roles with significant security or privacy responsibilities. Awareness changes attention, training changes competence; a programme that only has the former cannot fix skill gaps among developers or administrators, and one that only has the latter leaves the general workforce untouched.\n\nDesign choices that matter in practice are segmentation by risk exposure rather than by org chart (payment approvers, HR, privileged admins and executives face different pretexts), spacing and repetition instead of one annual block, and just-in-time delivery at the point of decision, where nudges complement formal learning. CIS Controls v8 Control 14 turns this into auditable safeguards, starting with establishing and maintaining the programme, training on social engineering, authentication and data handling, and adding role-specific training.\n\nMeasurement is where many programmes fail. Section 2.4 of SP 800-50r1 distinguishes activity metrics (attendance, cost per participant) from behaviour-change metrics such as the share of participants who report a simulated phishing email. Mature programmes track reporting rate, time-to-report, repeat-clicker trends and incidents with a human root cause, and treat click rates with caution because they depend heavily on how hard the template is. Field studies at UC San Diego Health (IEEE S&P 2025) and in a large organisation with more than 14,000 employees (IEEE S&P 2022) found little or no protective effect from annual training and embedded post-click lessons, which argues for pairing the programme with technical controls such as phishing-resistant MFA rather than expecting training alone to carry the risk. On the compliance side the programme is the evidence for ISO/IEC 27001:2022 clause 7.3 and Annex A 6.3, NIS2 Art. 21(2)(g) and, for financial entities, DORA Art. 13(6).","da":"NIST SP 800-50 Rev. 1 (september 2024) beskriver programmet som en livscyklus i fire faser med ét afsnit til hver: Plan and Strategy (afsnit 2), Analysis and Design (afsnit 3), Development and Implementation (afsnit 4) og Assessment and Improvement (afsnit 5). Faserne kan forløbe efter hinanden eller samtidig, og modellen er udtrykkeligt iterativ, så en ny trussel, en hændelse eller et nyt lovkrav kan sende programmet tilbage i cyklussen når som helst. I afsnit 3 bruger NIST den klassiske ADDIE-model for undervisningsdesign (Analysis, Design, Development, Implementation, Evaluation): Læringsbehov udledes af rollernes opgaver, målgrupperne defineres, behov kobles til målgrupper, nuværende viden vurderes, og hullerne fastlægges, før der skrives en eneste linje indhold.\n\nAfsnit 2.7 skelner mellem tre typer elementer: awareness-aktiviteter (loginbannere, nyhedsbreve, plakater, rettidige mails, temamåneder), der løbende når alle; erfaringsbaseret læring som phishing-, smishing- og vishing-simuleringer, tabletop-øvelser og scenarier i cyber ranges; og egentlig træning, der opbygger færdigheder hos roller med væsentligt sikkerheds- eller privatlivsansvar. Awareness ændrer opmærksomhed, træning ændrer kompetence; et program med kun det første kan ikke lukke kompetencehuller hos udviklere eller administratorer, og et program med kun det sidste lader den brede medarbejderstab være urørt.\n\nDe designvalg, der betyder noget i praksis, er segmentering efter risikoeksponering frem for organisationsdiagram (betalingsgodkendere, HR, privilegerede administratorer og direktionen møder forskellige påskud), spredte gentagelser frem for én årlig blok og levering lige dér, hvor beslutningen træffes, hvor nudges supplerer den formelle læring. CIS Controls v8 Control 14 omsætter det til reviderbare safeguards, der starter med at etablere og vedligeholde programmet, træne i social engineering, autentificering og datahåndtering og tilføje rollespecifik træning.\n\nMåling er dér, mange programmer fejler. Afsnit 2.4 i SP 800-50r1 skelner mellem aktivitetsmål (fremmøde, pris pr. deltager) og mål for adfærdsændring, fx andelen af deltagere, der melder en simuleret phishing-mail. Modne programmer følger meldeprocent, tid til melding, udviklingen i gengangere, der klikker igen, og hændelser med menneskelig grundårsag, og de behandler klikrater varsomt, fordi de afhænger stærkt af, hvor svær skabelonen er. Feltstudier på UC San Diego Health (IEEE S&P 2025) og i en stor organisation med over 14.000 ansatte (IEEE S&P 2022) fandt kun lille eller ingen beskyttende effekt af årlig træning og indlejrede lektioner efter et klik, hvilket taler for at koble programmet med tekniske kontroller som phishing-resistent MFA i stedet for at forvente, at træning alene bærer risikoen. På compliance-siden er programmet dokumentationen for ISO/IEC 27001:2022 pkt. 7.3 og bilag A 6.3, NIS2 art. 21, stk. 2, litra g, og for finansielle virksomheder DORA-forordningens art. 13, stk. 6."},"howTo":{"steps":{"en":["Name an owner, get backing and budget from management, and link the programme to the risk assessment and to duties such as the NIS2 requirement for cyber hygiene and training.","Analyse the needs - which roles face which threats, fx payment approvers, HR, administrators and managers - and what they know and do today.","Choose the target behaviours for each group, such as reporting suspicious emails quickly, and set measurable goals for them.","Plan a year of activities with short recurring themes, onboarding for new staff, phishing simulations, role-based training for high-risk roles and a separate session for management.","Produce or buy the content, test it on a few users first, and spread the delivery over the year instead of one annual block.","Make reporting easy with a report button and quick feedback, and pair the programme with technical controls such as phishing-resistant MFA.","Measure behaviour, such as reporting rate, time to report and repeat clickers, not just attendance, and report the results to management every quarter.","Revise the plan at least once a year and after incidents or new threats."],"da":["Udpeg en ejer, få opbakning og budget fra ledelsen, og kobl programmet til risikovurderingen og til krav som NIS2's krav om cyberhygiejne og uddannelse.","Analysér behovene - hvilke roller møder hvilke trusler, fx dem, der godkender betalinger, HR, administratorer og ledere - og hvad de ved og gør i dag.","Vælg den ønskede adfærd for hver målgruppe, fx at melde mistænkelige mails hurtigt, og sæt målbare mål for den.","Planlæg et år med korte tilbagevendende temaer, introduktion for nye medarbejdere, phishing-simuleringer, rollebaseret træning for højrisikoroller og en særskilt session for ledelsen.","Lav eller køb indholdet, test det først på nogle få brugere, og fordel indsatsen over året i stedet for én samlet blok om året.","Gør det nemt at melde med en meldeknap og hurtig tilbagemelding, og kombinér programmet med tekniske kontroller som phishing-resistent MFA.","Mål adfærd, fx meldeprocent, tid til melding og gengangere, der klikker igen, ikke kun fremmøde, og rapportér resultaterne til ledelsen hvert kvartal.","Revidér planen mindst en gang om året og efter hændelser eller nye trusler."]},"pitfalls":{"en":["Measuring only attendance or click rates, which depend on how hard the test is and say little about behaviour.","Running one annual course for everybody, instead of repeated activities aimed at the roles that face the most risk.","Shaming staff who click, which makes them less likely to report the next real attack.","Expecting training alone to stop phishing, when field studies show small effects and technical controls are still needed."],"da":["Kun at måle fremmøde eller klikrater, som afhænger af, hvor svær testen er, og siger meget lidt om adfærd.","At køre ét årligt kursus for alle i stedet for gentagne aktiviteter rettet mod de roller, der er mest udsatte.","At udskamme medarbejdere, der klikker, så de bliver mindre tilbøjelige til at melde det næste rigtige angreb.","At forvente, at træning alene stopper phishing, selv om feltstudier viser små effekter, og tekniske kontroller stadig er nødvendige."]},"guides":[{"title":"NIST SP 800-50 Rev. 1 - Building a Cybersecurity and Privacy Learning Program","url":"https://csrc.nist.gov/pubs/sp/800/50/r1/final","publisher":"NIST","tier":"standard"},{"title":"CIS Critical Security Control 14: Security Awareness and Skills Training","url":"https://www.cisecurity.org/controls/security-awareness-and-skills-training","publisher":"Center for Internet Security","tier":"standard"},{"title":"Om at arbejde med adfærdsindsatser","url":"https://www.sikkerdigital.dk/myndighed/uddannelse-og-awareness/om-at-arbejde-med-adfaerdsindsatser","publisher":"Styrelsen for Samfundssikkerhed","tier":"official-doc","lang":"da"}]},"edges":[{"type":"requires","to":"security/security-awareness","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/human-error","why":{"en":"Regular, practical training makes common mistakes less likely and faster to report.","da":"Løbende, praktisk træning gør almindelige fejl mindre sandsynlige og hurtigere at melde."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/nudging","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-metrics","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 2","tier":"course-material"},{"title":"NIST SP 800-50 Rev. 1 - Building a Cybersecurity and Privacy Learning Program","tier":"standard"},{"title":"Ho et al. - Understanding the Efficacy of Phishing Training in Practice (IEEE S&P 2025)","url":"https://people.cs.uchicago.edu/~grantho/papers/oakland2025_phishing-training.pdf","tier":"other","publisher":"IEEE"}],"draft":true}