Security awareness
Most incidents involve a person. We set up concrete awareness, fitted to your roles, to reduce risk without turning every employee into an expert.
What we see too often
A once-a-year e-learning capsule convinces neither the auditor nor your staff. Clause 7.3 requires that concerned people understand their role, not that they clicked “next”.
- generic training, with no link to your policies or incidents
- no attendance evidence, or evidence nobody can find
- new joiners wait months before a briefing
- leadership never received a different message from staff
- confusion between awareness, technical competence and internal marketing
What this module is
Awareness means telling each person what is expected: passwords, incidents, classification, suppliers, remote work. It is not training everyone to become an analyst.
We build a short, repeated programme, with evidence (attendance, acknowledgement, a simple quiz) and onboarding. Content aligns with your real policies, not a catalogue of horrors.
Where this sits in ISO 27001
The module covers clause 7.3 (awareness) and leans on clause 7.2 competence without replacing it. Policies must exist, even if imperfect.
What this module includes
- Role-based targeting (everyone, IT, leadership, developers)
- Messages tied to your incidents and policies
- Participation evidence
- Periodic reminders and a simple effectiveness measure
How we work
Audiences and messages
Leadership, staff, freelancers, IT. The same deck for everyone is a sign you did not target.
Content fitted to your rules
We start from your policies and real incidents (even minor ones). No off-topic scare stories.
Channels and rhythm
Onboarding, yearly reminder, micro-messages. A rhythm you will keep, not a content factory.
Evidence
Who attended, when, what. A simple register. Without evidence, awareness does not exist in audit.
What you receive
- Annual awareness plan
- Materials for 2 or 3 audiences
- Participation register
- Short quiz or exercise with aggregated results
Who it is for
Organizations that need training evidence for audit, not only a generic video once a year.
Who it is not for
This module is not internal-auditor training, nor a 52-week phishing programme (unless you ask for that separately). It does not write the policies.
Typical duration
2 to 4 weeks for the framework, then an annual rhythm.
What you need to provide
You provide the list of concerned people (including freelancers), current policies, and an internal channel (email, meeting, LMS).
What this module does not cover
This module shapes behaviour. It does not replace policies, nor a large-scale social-engineering test.
Frequently asked questions
- Is off-the-shelf e-learning enough?
- As a complement, sometimes. Audit also wants a link to your rules, your incidents and participation evidence.
- Should contractors be trained?
- Yes, if they access your information. The plan covers them, with a shorter format if needed.
- How do we measure effectiveness?
- Participation rate, quiz results, and optionally a limited phishing exercise, without humiliating teams.
- Can we buy only this module?
- Yes. Each module is sold separately. You do not have to buy the full programme. The pre-assessment remains the most efficient entry point if you do not yet know where to start.
- Do we have to start with the pre-assessment?
- No, it is not mandatory. The pre-assessment speeds up scoping if you do not yet have a full picture. If you already know what is missing, we can start this module directly.