Implementing a security awareness strategy

A strategic goal to become the person, team, function or department to whom people turn for advice on information risk, security and related matters is laudable, but what does that actually mean in fact? What would you need to do to achieve it? What would it require to put it into effect? How would you know whether it was working?

Thinking through the implications and questions of that nature will suggest a number of avenues to work on, for instance:

• Becoming known as a source of advice means people need your contact details, the means to get in touch. Furthermore, the advisory services you offer need to be sound and strong, beneficial both to the business and to the individuals seeking advice. This implies the need to publicize and promote your activities, perhaps through an internal marketing campaign;
• Some people may be reluctant to approach you, for various rational and irrational reasons: figure those out and tackle them one-by-one, as best you can. An open-door policy is just one of many possibilities here. To what extent do people trust and value your services?;
• Aside from the services themselves, the manner in which your services are delivered is another factor. What can you do to make it easier, more productive/effective and generally better for your clients? How might you exceed their expectations? Service quality assurance may be something worth some effort.
• Success breeds success, so how about using successful interactions and assignments as tasters of what you offer?  Even better, can you turn clients into advocates, helping to convince others to come to you?
• There are lots of ways of measuring your awareness and training activities, loads of possible metrics. Inquiries, responses, assignments and engagements, client perceptions and satisfaction can all be measured. Rather than attempt to measure everything, home-in on the aspects that matter most and/or the metrics that give you the most useful information, the most insight ... and if appropriate use these metrics along with client feedback as part of your promotional activities, as well as using them to drive out success.

[This is just one of a bunch of awareness tips in the train-the-trainer guide for our next awareness module. Each month we suggest a handful of creative activities, some relating to the awareness topic at hand and others more general in nature. As we approach our 200th module, perhaps I ought to sift through the entire Back Catalog, collating and structuring the tips into a collection of some sort - maybe even another book ...]