The IT Regulatory and Standards Compliance Handbook

Chapter 8. Assessing Security Awareness and Knowledge of Policy

Solutions in this chapter:

▪ Security Awareness and Training

▪ Testing Knowledge and Security Awareness

Summary

Introduction

In this chapter we look at what is needed to ensure the success of a security program, awareness. This process, as defined in the National Institute of Standards and Technology (NIST) documentation, ¹ consists of the following stages:

1 Developing IT policy that reflects business needs tempered by known risks;

2 Informing users on the key security responsibilities, as documented in the security policy and procedures; and

3 Establishing processes for monitoring and reviewing the program.

It is crucial that the senior management and executives of an organization lead ...