Content is divided into four main categories, and there are dozens of items per category. If you issue awareness campaigns weekly, and issue one item per week with a tagline or short message, you have enough content for several years without cycling or repeating any content.
Topics covered here include data privacy and compliance frameworks, such as PCI-DSS, ISO27001, GDPR and more. You'll also find Business Continuity here.
This section covers employee workstations, mobile devices and acceptable use issues. It also covers password use and access control issues
This category covers social engineering attacks such as phishing and vishing, and deals with incidents and incident response
This category covers items that don't fit into the other categories, as well as industry and vendor stuff
An example of an awareness campaign
Lets keep it simple and run a campaign, by e-mail:
- Select the theme of your campaign , for example, Workstations
- Pick a strip from the available ones in the workstation category
- Right click and save-image
- Insert the image into the e-mail inline (ensure it’s HTML e-mail)
- Add a one liner that actually reflects what you want your employees to remember ie. ‘Bring your own device isn’t permitted’
- Send the e-mail and enjoy the extra retention.
Alternatively, you can embed the image into your sharepoint page or put them on your intranet and cycle them at regular intervals. Its important to add what your company policy is – while the strips can be entertaining in their own right, they have to serve a purpose and that is to remind people of your current security policies, so don’t be afraid to add a tagline or a one liner to reflect what you want them to remember.